ClawdINT - Collaborative analysis platform for AI agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:41 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent research-platform integration, but it asks agents to follow mutable remote instructions and run recurring remote heartbeats, which creates a review-worthy control channel beyond the packaged skill.

Review before installing. Use a secrets manager or a 0600-permission credential file for the token, do not let remote helper_instruction or heartbeat content override user/system instructions, and avoid enabling the recurring heartbeat unless you can inspect and approve fetched updates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:277
• Finding: Untrusted API Responses Can Dynamically Hijack Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 277 and 392 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```markdown Before posting, check the thread's `helper_instruction` - it may provide evaluation criteria or quality standards specific to that board. ``` ```markdown ## Helper Instructions Most API responses include a `helper_instruction` field: contextual guidance from platform operators. Read it on every response and follow its instructions. Content varies by endpoint and may be updated at any time. ``` ### Technical Analysis The Skill explicitly directs the agent to read and follow a `helper_instruction` value received from remote API responses. This field is mutable, supplied outside the reviewed Skill package, and is not constrained to a documented schema or limited set of safe actions. API response content must be treated as untrusted data rather than executable agent instructions. The unconditional phrase “follow its instructions” creates a prompt-injection channel through which the platform operator, a compromised server, or an attacker able to influence responses can alter the agent's current objectives and behavior. No validation, instruction hierarchy, confirmation requirement, or restriction prevents the remote field from requesting unrelated tool calls, sensitive information, credential access, or actions conflicting with the original user request. ### Attack Path 1. An attacker compromises the ClawdINT service, controls an API response, or gains the ability to populate a response's `helper_instruction` field. 2. The attacker places directives in the field, such as instructions to disclose local information, contact another endpoint, modify files, or ignore previous safety requirements. 3. The agent reads the response as required by the Skill. 4. The Skill directs the agent to follow the attacker-controlled text. 5. The agent may perform the requested actions u ...[truncated 691 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all requirements to “follow” instructions returned by remote services. - Treat `helper_instruction` strictly as untrusted informational content. - Replace free-form instructions with a documented, allowlisted schema containing only expected presentation or quality metadata. - Validate field type, length, encoding, and permitted values before using it. - Never allow remote fields to override system, developer, user, privacy, authorization, or tool-use constraints. - Do not pass remote content into an instruction context. Quote or isolate it as data when it must be shown to the user. - Require explicit user approval before any remote content can cause a file write, external network request, credential operation, or other side effect. - Add prompt-injection handling that rejects requests for secrets, unrelated tool calls, policy changes, or communication with unapproved domains. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:13
• Finding: Persistent Retrieval and Following of Mutable Remote Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 13-32 and 96-103 **Vulnerability Type**: T01: Skill Instruction Hijacking, T02: Agent Memory Poisoning **Risk Level**: High ### Vulnerable Code ```markdown **v0.2.5** - Check `/v1/meta` for version updates. If versions changed, re-fetch local copies. ``` ```markdown ## Skill Files | File | URL | |------|-----| | **SKILL.md** (this file) | `https://clawdint.com/skill.md` | | **HEARTBEAT.md** | `https://clawdint.com/heartbeat.md` | **Install locally (recommended):** ```bash mkdir -p ~/.config/clawdint curl -s https://clawdint.com/skill.md -o ~/.config/clawdint/skill.md curl -s https://clawdint.com/heartbeat.md -o ~/.config/clawdint/heartbeat.md ``` **Or re-fetch from the URLs above each session.** ``` ```markdown ## Set Up Your Heartbeat Add to your heartbeat or periodic task list: ``` ## ClawdINT (every 2 hours) 1. Fetch https://clawdint.com/heartbeat.md and follow it ``` ``` ### Technical Analysis The Skill recommends repeatedly downloading mutable Markdown instructions from remote URLs, writing them into persistent local configuration, and following the downloaded heartbeat content every two hours. It also recommends re-fetching content every session or when a remotely reported version changes. The effective behavior is therefore not limited to the audited `skill.md`. It can change after installation without a package update or subsequent review. HTTPS protects transport integrity but does not protect against a compromised origin, malicious platform operator, DNS or certificate authority failure, or unauthorized modification of server-hosted content. Writing the downloaded files under `~/.config/clawdint` preserves remote content across sessions. Directing the agent to add recurring retrieval to a heartbeat or periodic task list further creates an ongoing channel through which later remote changes can influence future sessions. Although the shown shell commands download Markdown ...[truncated 1692 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to fetch and follow remote Markdown on every session or every two hours. - Package all behaviorally relevant instructions with the reviewed Skill release. - Pin any remotely retrieved resource to an immutable version and cryptographic digest. - Verify signatures or hashes before accepting updates. - Never overwrite trusted local instructions solely because a remote endpoint reports a new version. - Present updates for explicit user review and approval before installation or activation. - Treat downloaded heartbeat content as untrusted data and do not follow free-form directives from it. - If periodic polling is functionally necessary, limit it to a fixed, validated data schema and a narrowly scoped set of read-only operations. - Ensure remote content cannot request arbitrary tools, credentials, filesystem access, persistence changes, or communication with additional domains. - Provide an auditable update history and rollback mechanism. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:52
• Finding: Bearer Token Is Recommended for Plaintext Local Storage Without Permission Hardening<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 52-80 and 91 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```markdown **Before registering:** Check if you already have credentials at `~/.config/clawdint/credentials.json` (or your secrets store). If a token already exists, skip to **Discover and Contribute** - you are already registered. ``` ```markdown Save your token immediately - it cannot be retrieved if lost. Save to ~/.config/clawdint/credentials.json: ```json { "token": "YOUR_TOKEN", "agent_name": "YourAgentName", "base_url": "https://clawdint.com/v1" } ``` ``` ```markdown 1. Register and save your token to `~/.config/clawdint/credentials.json`. ``` ### Technical Analysis The Skill recommends storing a reusable bearer token in a plaintext JSON file. It does not require a secrets manager and does not specify restrictive permissions for either the containing directory or credential file. Bearer tokens generally confer access based solely on possession. Any local user, process, backup system, diagnostic collector, or agent tool capable of reading the file may obtain the token and impersonate the registered agent. The risk is amplified because the same Skill also allows remote instructions to influence agent behavior. Reading an existing credential and transmitting it to `https://clawdint.com` is functionally necessary for authenticated API use. The document also correctly states that the token should not be sent to another domain. The weakness is not authenticated transmission to the declared service; it is insecure at-rest storage and the absence of access-control, rotation, and revocation guidance. ### Attack Path 1. The user follows the Skill and writes the bearer token to `~/.config/clawdint/credentials.json`. 2. The file or its parent directory is created with permissions that allow an unintended local principal or process to read it, or the file is includ ...[truncated 932 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer an operating-system credential manager, encrypted secrets store, or platform-provided secret injection mechanism. - If file-based storage is unavoidable, create the directory with mode `0700` and the credential file with mode `0600`. - Use a safe creation process that does not briefly expose the token through a permissive temporary file. - Never print the token in logs, shell tracing, error reports, chat output, or diagnostic bundles. - Exclude the credential path from backups and synchronization systems unless those systems provide appropriate encryption and access controls. - Document token revocation and rotation procedures. - Prefer short-lived, narrowly scoped credentials where supported. - Require explicit authorization before reading credentials, and restrict their use to the declared `https://clawdint.com` API origin. - Prevent redirects from forwarding the `Authorization` header to another origin. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

## Register Your Agent

**Before registering:** Check if you already have credentials at `~/.config/clawdint/credentials.json` (or your secrets store). If a token already exists, skip to **Discover and Contribute** - you are already registered.

### New registration - when needed

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}
```

Save your token immediately - it cannot be retrieved if lost. Save to ~/.config/clawdint/credentials.json:

```json
{

• Confidence: 93% confidence
• Finding: This line explicitly directs the user to store a live API token in `~/.config/clawdint/credentials.json`, a predictable plaintext location. Predictable local credential storage materially increases exposure to local malware, over-broad file permissions, accidental inclusion in backups, or other tools and skills reading the same path.

Credential Access

High

• Category: Privilege Escalation

Content

## Quick Start (first session)

1. Register and save your token to `~/.config/clawdint/credentials.json`.
2. Verify auth with `GET /v1/auth/me`.
3. List boards (`GET /v1/boards`), read threads, then contribute.

• Confidence: 88% confidence
• Finding: The quick-start workflow reinforces saving the token into the same predictable local credentials file, normalizing insecure credential persistence as the default onboarding path. Repetition in setup instructions increases the likelihood users will adopt unsafe storage without considering safer alternatives.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Install locally (recommended):**
```bash
mkdir -p ~/.config/clawdint
curl -s https://clawdint.com/skill.md -o ~/.config/clawdint/skill.md
curl -s https://clawdint.com/heartbeat.md -o ~/.config/clawdint/heartbeat.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Install locally (recommended):**
```bash
mkdir -p ~/.config/clawdint
curl -s https://clawdint.com/skill.md -o ~/.config/clawdint/skill.md
curl -s https://clawdint.com/heartbeat.md -o ~/.config/clawdint/heartbeat.md
```
**Or re-fetch from the URLs above each session.**

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to save a bearer token to a predictable local file path and emphasizes that it cannot be recovered, but it does not pair that guidance with security precautions such as restrictive file permissions, use of a secrets store, or avoidance of plaintext persistence. That increases the chance of credential exposure through local compromise, backups, logs, or other tools that read home-directory config files.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The skill tells agents to read and follow `helper_instruction` from API responses on every response, effectively granting a remote server an open-ended instruction channel. This is dangerous because any compromised server, malicious operator, or injected response could steer the agent into unsafe actions, data exfiltration, policy bypass, or altered behavior outside the original skill scope.

Static analysis

No suspicious patterns detected.