CatchClaw

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 3.5.8

Overview

CatchClaw fits its marketplace-manager purpose in broad terms, but it has unsafe install and workspace-write behavior that users should review carefully before installing.

Treat this as a Review install. Do not run install.sh unless the publisher adds integrity verification. If evaluating manually, use a disposable OpenClaw profile, avoid --overwrite, rollback --latest, and --api-key, keep registries pinned to trusted HTTPS endpoints, and inspect both downloaded agentars and exported ZIPs for unexpected files or secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:4

Finding

Unverified Remote Installer Download and Execution

Content

View full analysis

&2 find "$TMP_DIR" -maxdepth 3 -print >&2 exit 1 fi bash "$INSTALLER" "$@" ``` ### Technical Analysis The installer downloads a compressed archive and immediately executes the `cli/install.sh` file extracted from it. It performs no SHA-256 verification, signature validation, publisher verification, or content review. The `AGENTAR_KIT_URL` environment variable can replace the default URL with an arbitrary source. The use of `curl -L` also follows redirects without restricting the destination origin or preventing an HTTPS-to-HTTP downgrade. Consequently, the effective code executed by this Skill can differ from the code that was statically audited. This behavior is unnecessary for the declared workflow because `SKILL.md:25-34` explicitly states that `agentar_cli.mjs` is bundled and that no download or copy is required. There is also a version discrepancy: the remote artifact is named `agentar-cli-v3.3.2`, while the bundled CLI declares version `3.4.2`. ### Attack Path 1. An attacker influences the environment in which the installer runs and sets `AGENTAR_KIT_URL` to an attacker-controlled URL. Alternatively, the release asset, hosting account, or redirect destination is compromised. 2. The attacker supplies a valid gzip archive containing `cli/install.sh`. 3. `curl` downloads the archive without integrity or authenticity validation. 4. `tar` ex ...[truncated 681 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: agentar_cli.mjs:852

Finding

Agent Name Path Traversal Allows Writes Outside the Workspace Directory

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: agentar_cli.mjs:795

Finding

Marketplace Agent Packages Are Installed Without Authenticity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: agentar_cli.mjs:305

Finding

API Keys Are Exposed Through Command Arguments and Weak Plaintext Storage

Content

View full analysis

`. 2. The key becomes part of the command line and may persist in shell history or be visible in process metadata while the command runs. 3. The CLI writes the key to a plaintext file using inherited default permissions. 4. Another local user or process with sufficient filesystem access reads the key from process metadata, history, backups, or `.credentials`. 5. T ...[truncated 363 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: agentar_cli.mjs:253

Finding

Incomplete Export Filtering Can Package Sensitive Workspace Files

Content

View full analysis

name === p || name.endsWith(p)); } function cpSyncFiltered(src, dest, skipped) { mkdirp(dest); for (const entry of readdirEntries(src)) { const s = path.join(src, entry.name); const d = path.join(dest, entry.name); if (isSensitiveFile(entry.name)) { skipped.push(path.relative(src, s)); continue; } if (entry.isDirectory()) { cpSyncFiltered(s, d, skipped); } else { copyFile(s, d); } } } ``` Export relies on that narrow filter: ```js for (const entry of readdirEntries(workspaceDir)) { if (entry.isDirectory() && EXPORT_SKIP_DIRS.includes(entry.name)) continue; if (entry.name === "skills" && entry.isDirectory()) continue; if (SKIP_FILES.includes(entry.name)) continue; if (entry.name === "MEMORY.md" && !includeMemory) continue; if (entry.name.startsWith(".")) continue; const src = path.join(workspaceDir, entry.name); const dest = path.join(tmp, entry.name); if (entry.isDirectory()) { const skipped = []; cpSyncFiltered(src, dest, skipped); for (const s of skipped) allSkipped.push(`${entry.name}/${s}`); } else { if (isSensitiveFile(entry.name)) { allSkipped.push(entry.name); continue; } copyFile(src, dest); } } ``` ### Technical Analysis The filter is case-sensitive and recognizes only five exact names or suffixes. It does not identify many common secret-bearing files, including `credentials.json`, `secrets.yaml`, `token`, `id_rsa`, `.npmrc`, `.pypirc`, uppercase variants, or ap ...[truncated 1333 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: agentar_cli.mjs:372

Finding

Unbounded ZIP Inflation Enables Memory and Disk Exhaustion

Content

View full analysis

= 0; i--) { if (buf.readUInt32LE(i) === 0x06054b50) { eocdOffset = i; break; } } if (eocdOffset < 0) throw new Error("invalid zip: EOCD not found"); const cdOffset = buf.readUInt32LE(eocdOffset + 16); const cdCount = buf.readUInt16LE(eocdOffset + 10); const cdEntries = []; let pos = cdOffset; for (let i = 0; i < cdCount; i++) { if (buf.readUInt32LE(pos) !== 0x02014b50) break; const method = buf.readUInt16LE(pos + 10); const compSize = buf.readUInt32LE(pos + 20); const uncompSize = buf.readUInt32LE(pos + 24); const nameLen = buf.readUInt16LE(pos + 28); const extraLen = buf.readUInt16LE(pos + 30); const commentLen = buf.readUInt16LE(pos + 32); const localOffset = buf.readUInt32LE(pos + 42); const flags = buf.readUInt16LE(pos + 8); const nameBytes = buf.subarray(pos + 46, pos + 46 + nameLen); const isUtf8 = (flags & 0x800) !== 0; const entryName = isUtf8 ? nameBytes.toString("utf-8") : decodeCP437(nameBytes); cdEntries.push({ entryName, method, compSize, uncompSize, localOffset }); pos += 46 + nameLen + extraLen + commentLen; } for (const cd of cdEntries) { const lhNameLen = buf.readUInt16LE(cd.localOffset + 26); const lhExtraLen = buf.readUInt16LE(cd.localOffset + 28); const dataStart = cd.localOffset + 30 + lhNameLen + lhExtraLen; const rawData = buf.subarray(dataStart, dataStart + cd.compSize); const normalized = path.normalize(cd.entryName); if (path.isAbsolute(normalized) || normalized.startsWith("..")) continue; const dest = path.join(destDir, normalized); ...[truncated 1976 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior says this skill searches, installs, and exports agentars, but the finding indicates effective behavior includes retrieving and executing code through a bundled Node CLI with network-dependent installation logic that is not transparently described. Any mismatch between declared purpose and actual execution behavior is dangerous because it can hide code execution, remote content ingestion, or workspace modification behind an innocuous marketplace-management description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentar_cli.mjs (reported line 42)May include surrounding context.

js

];
const SKIP_FILES = ["AGENTS.md", "BOOTSTRAP.md"];
const EXPORT_SKIP_DIRS = [".git", ".openclaw", "__MACOSX", "memory"];
const SENSITIVE_PATTERNS = [".credentials", ".env", ".secret", ".key", ".pem"];

// ─── Config ──────────────────────────────────────────────────────────────────

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script downloads a tarball from a remote URL and then directly executes an extracted install.sh without verifying a checksum, signature, pinned digest, or trusted publisher identity. Because the source URL is also overridable via AGENTAR_KIT_URL, an attacker who can influence the environment, release artifact, network path, or upstream repository can achieve arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run shell commands and rely on environment variables, but it declares no explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where a reviewer or runtime may underestimate the skill's ability to execute commands, access local paths, and modify workspaces.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The skill is designed to install agent archives into existing agent workspaces and can overwrite the main workspace with a single command. This is persistent state modification, and in the context of agent skills it is particularly sensitive because imported workspace content may alter future agent behavior, add new skills, or replace existing instructions across sessions.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

**Source:** This skill is from the [CatchClaw skill repository](https://github.com/OpenAgentar/catchclaw).

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

## Trigger Conditions

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions activate on broad phrases and even mere mention of keywords like "agentar" or "catchclaw." Overbroad activation increases the chance the skill runs in unrelated conversations, leading to unintended shell execution, network access, or workspace-changing actions in contexts where the user did not clearly request them.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The install command writes files into agent workspaces and may also save credentials to a skill-local file. Persistent writes are risky because a marketplace package can introduce long-lived configuration changes, new executable instructions, or secret material that remains available after the current session.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash

$CLI install <slug> --name <name> [--api-key <key>]
$CLI install <slug> --overwrite

Install an agentar from the marketplace.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

**Important:**
- Do NOT execute install until the user explicitly selects one of the above options
- Do NOT use "new" as a default without asking
- Do NOT use "overwrite" unless the user explicitly selects it
- If the user chooses "new" but doesn't specify a name, use the slug as the default name

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This marketplace skill dynamically resolves the child_process module and spawns the external openclaw binary to create agents, list agents, and send an AI prompt for metadata enrichment. Spawning subprocesses and running another agent CLI is not clearly justified by the stated purpose of searching, installing, and exporting marketplace agent templates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The install path writes an API key into skills/.credentials on disk without an explicit warning or consent at the moment of storage. Persisting secrets locally increases exposure to accidental disclosure through backups, file permissions, later packaging mistakes, or compromise of the workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The export flow sends workspace-derived content to another agent process for AI enrichment, which can leak sensitive data from SOUL.md, IDENTITY.md, or other local agent context to a separate model/runtime outside the user's immediate expectation. Because this happens during export and is enabled by default, a malicious or sensitive workspace can trigger unintended disclosure or prompt-injection-style influence over the generated metadata.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · agentar_cli.mjs (reported line 1115)May include surrounding context.

js

mode = "new";
  } else {
    const choice = await prompt(
      `Install agentar "${slug}":\n  [1] Create a new agent (default)\n  [2] Overwrite main agent (~/.openclaw/workspace)\nChoice (1/2, default 1): `,
    );
    mode = choice === "2" ? "overwrite" : "new";
    if (mode === "new" && !opts.name) {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a marketplace skill for finding, installing, or packaging agent templates, but this CLI also implements a separate rollback command that enumerates backups, deletes the main workspace, and restores prior workspace contents. Restoring arbitrary prior state is not an obvious implementation detail of marketplace search/install/export and materially expands the skill's operational scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using --latest allows destructive replacement of the main workspace without a confirmation prompt, which can cause accidental loss or rollback to an unintended state. In a CLI handling agent workspaces, this is dangerous because a single command or script invocation can overwrite active state non-interactively.

Content

No source excerpt is available for this finding.