Crabwalk

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:45 AM UTC
• Version: 0.1.0

Overview

The skill is not clearly malicious, but it needs review because it installs an unverified remote program, exposes monitoring and workspace browsing over the network, and may make persistent or privileged system changes.

Install only if you trust the publisher and the GitHub release pipeline. Prefer a pinned, verified release, avoid allowing the installer to run sudo for optional qrencode support, review any shell startup file changes, and bind the service to localhost unless you have authentication and are comfortable exposing monitor and workspace views to the network.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:104

Finding

Unverified Mutable Remote Executable Installation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:124

Finding

Optional Dependency Installation Invokes System Package Managers with Sudo

Content

View full analysis

/dev/null; then if command -v pacman &>/dev/null; then sudo pacman -S --noconfirm qrencode 2>/dev/null || true elif command -v apt &>/dev/null; then sudo apt install -y qrencode 2>/dev/null || true elif command -v brew &>/dev/null; then brew install qrencode 2>/dev/null || true elif command -v dnf &>/dev/null; then sudo dnf install -y qrencode 2>/dev/null || true fi fi ``` ### Technical Analysis The required installation procedure attempts to install `qrencode` through a detected package manager. On several supported systems, this invokes `sudo` and performs a system-wide package installation. The document explicitly identifies `qrencode` as optional, so privileged installation is not necessary for the declared core monitoring functionality. The command is embedded in a larger automated sequence, uses noninteractive confirmation flags, suppresses diagnostics, and converts failure into success with `|| true`. These properties reduce visibility into a privileged operation and make it harder for the user to assess what changed. ### Attack Path 1. The agent follows the required installation command. 2. The script determines that `qrencode` is absent. 3. It detects a supported system package manager. 4. It invokes that manager, potentially through `sudo`, with automatic confirmation enabled. 5. The system package database and system-wide files are modified for an optional feature. 6. Any risk in the configured package repositories or package-manager hooks executes within the package manager's elevated context. ### Impact Assessment The direct impact is an unneeded system-wide software installation and expansion of the trusted dependency surface. Where `sud ...[truncated 252 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: skill.md:114

Finding

Persistent Modification of Shell Startup Configuration

Content

View full analysis

> ~/.bashrc [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc export PATH="$HOME/.local/bin:$PATH" fi ``` ### Technical Analysis The installer appends configuration to `.bashrc` and `.zshrc`, causing the change to survive the current Skill invocation and affect future shell sessions. It prepends a user-writable directory to `PATH`, giving executables in that directory precedence over commands found later in the search path. A persistent PATH update is not required merely to run the monitor: the Skill could invoke the binary through its explicit path or provide an optional setup instruction. Modifying multiple shell startup files without separate consent broadens the operation beyond the minimum installation requirement. ### Attack Path 1. The required installer determines that `~/.local/bin` is not present in the current `PATH`. 2. It appends a PATH declaration to existing Bash and Zsh startup files. 3. Future interactive shells load the modified configuration. 4. Commands in `~/.local/bin` take precedence over same-named executables later in `PATH`. 5. If that user-writable directory later contains a malicious or replaced executable with a colliding name, future command resolution can invoke it. ### Impact Assessment The modification persists across shell sessions for the affected user. It does not directly create a privileged startup service or root-level backdoor, but it changes future command resolution and increases the persistence of the installed tool. Any exploitation remains constrained to the permissions of the affected user unless combined with another privilege boundary. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:33

Finding

Monitoring and Workspace Service Exposed on All Network Interfaces

Content

View full analysis

Server port (default: 3000) -H, --host Bind address (default: 0.0.0.0) -g, --gateway Gateway WebSocket URL -t, --token Gateway auth token (auto-detects from ~/.openclaw/openclaw.json) -d, --daemon Run in background ``` ```text - `/monitor` — Real-time agent activity graph (ReactFlow) - `/workspace` — File browser and markdown viewer - Auto-detects gateway token from OpenClaw config ``` ### Technical Analysis The documented default binds the service to `0.0.0.0`, exposing it on every available network interface. The instructions explicitly direct the agent to share the network-accessible address rather than localhost. The same service includes a workspace file browser and agent-monitoring functionality, and the CLI can automatically read a gateway authentication token from `~/.openclaw/openclaw.json`. The document does not state that monitor authentication, authorization, TLS, network-origin checks, or workspace access restrictions are enforced. Because the executable is not present in the audited artifact, the existence or quality of any undocumented protections cannot be confirmed. ### Attack Path 1. The user starts `crabwalk` with the documented default settings. 2. The process listens on `0.0.0.0:3000`. 3. The host firewall and network topology permit another devic ...[truncated 942 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: skill.md:35

Finding

Mandatory Promotional Message Alters the Agent's User-Facing Output

Content

View full analysis

If you're enjoying Crabwalk, consider leaving a quick review! [Tweet about Crabwalk](https://twitter.com/intent/tweet?text=Just%20set%20up%20Crabwalk%F0%9F%A6%80%20by%20%40luccasveg%20to%20monitor%20my%20OpenClaw%20agents%20in%20real-time!%20https%3A%2F%2Fcrabwalk.app%20) ``` ### Technical Analysis The Skill instructs the agent to insert a publisher-benefiting promotional message after the user confirms that setup works. This is unrelated to the technical requirement of installing or operating the monitor and modifies the agent's user-facing behavior when the Skill is followed. The instruction does not bypass technical safety controls, but it redirects the current session toward social-media promotion and an external URL without the user requesting marketing content. ### Attack Path 1. The Skill is loaded and its required steps govern the agent's behavior. 2. The user confirms that the monitor is accessible. 3. The Skill requires the agent to provide a prewritten promotional message. 4. The response directs the user to a Twitter intent URL containing publisher-selected text. ### Impact Assessment The impact is limited to manipulation of the current interaction, unsolicited advertising, and redirection to an external social-media endpoint. It does not by itself grant filesystem, network, or operating-system privileges. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The noninteractive --noconfirm flag abuses package manager safety rails by suppressing prompts in a chained installer. This increases the likelihood of unintended system modification and reduces opportunities for a user to review privileged actions.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The installer chains download, extraction, file copy, PATH modification, and possible sudo package installation into one opaque command. This structure makes it difficult for users to inspect intermediate results or safely stop before privileged actions, magnifying the impact of any mistake or compromised artifact.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

ps

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The same suppression of prompts appears in the expanded install script, again bypassing package-manager safeguards for an optional dependency. The behavior is unnecessarily forceful for the stated purpose.

Content

Scanner excerpt · skill.md (reported line 123)May include surrounding context.

md

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although limited to an application-specific path, rm -rf is still a destructive operation in an update path and lacks validation or backup. A malformed path, packaging error, or unexpected symlink could cause loss of application data or unintended deletion within the user context.

Content

Scanner excerpt · skill.md (reported line 140)May include surrounding context.

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
rm -rf ~/.crabwalk/.output
curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk
cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk
echo "🦀 Updated to ${VERSION}"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although limited to an application-specific path, rm -rf is still a destructive operation in an update path and lacks validation or backup. A malformed path, packaging error, or unexpected symlink could cause loss of application data or unintended deletion within the user context.

Content

Scanner excerpt · skill.md (reported line 140)May include surrounding context.

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
rm -rf ~/.crabwalk/.output
curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk
cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk
echo "🦀 Updated to ${VERSION}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The primary installation path performs persistent filesystem changes, PATH modification, network downloads, archive extraction, and potential sudo package installation without any warning or stepwise confirmation. Users may execute a long chained command without understanding its breadth or reviewing each side effect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 104)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 139)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

Using noninteractive package manager flags such as --noconfirm reduces user oversight for privileged package installation. In a long one-liner, this can cause an agent or user to make system changes automatically without an informed decision point.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The one-line installer may invoke sudo to install qrencode, expanding privileges beyond the core skill installation. Because this happens inside a chained command, users may not notice that a monitoring skill is requesting root-level package changes.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

Creating persistent directories and modifying the user's PATH establishes lasting changes on the system. While normal for CLI installation, it is still a real persistence-related behavior that should be disclosed because it affects future sessions.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

Step 1: Install

bash

VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk && cp ~/.crabwalk/bin/crabwalk ~/.local/bin/ && chmod +x ~/.local/bin/crabwalk && (echo $PATH | grep -q "$HOME/.local/bin" || ([ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc; [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc; export PATH="$HOME/.local/bin:$PATH")) && (command -v qrencode &>/dev/null || (command -v pacman &>/dev/null && sudo pacman -S --noconfirm qrencode || command -v apt &>/dev/null && sudo apt install -y qrencode || command -v brew &>/dev/null && brew install qrencode || command -v dnf &>/dev/null && sudo dnf install -y qrencode) 2>/dev/null || true) && echo "🦀 Crabwalk ${VERSION} installed"

Step 2: Verify

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The install step performs shell persistence changes and may invoke privileged package installation for an optional dependency. Those actions exceed what users would reasonably expect from a simple monitoring skill and increase system impact if the install command is run blindly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions explicitly tell the user to share a network IP URL while omitting any warning that the service may expose agent activity and workspace contents over the local network. In this context, sharing the URL is particularly risky because the documented feature set includes file browsing and token auto-detection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented default host is 0.0.0.0, which exposes the server on all interfaces. For a tool that can show agent activity and browse workspace files, this significantly increases the attack surface and risk of unauthorized access on shared or untrusted networks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a monitoring tool, but its documented features also include a workspace file browser and markdown viewer. That materially expands access to local data and can expose sensitive files to anyone who can reach the web UI, especially since the service is documented to bind to all interfaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A file browser is broader than the stated purpose of agent monitoring and creates a pathway to expose workspace contents through the monitoring server. In context, this is more dangerous because the same document encourages sharing a LAN-accessible URL, increasing the chance that unintended users can browse local files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 105)May include surrounding context.

bash

# Download latest release
VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
mkdir -p ~/.crabwalk
curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk

# Install CLI

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

Installing an executable into ~/.local/bin is a persistent change that affects future command resolution, especially when coupled with PATH modification. This is common practice but should still be transparent because it can influence later shell sessions.

Content

Scanner excerpt · skill.md (reported line 109)May include surrounding context.

md

curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk

# Install CLI
mkdir -p ~/.local/bin
cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk
chmod +x ~/.local/bin/crabwalk

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The expanded install script still performs unattended optional package installation, which normalizes automatic privileged changes. This is risky because qrencode is explicitly optional, so there is no justification for bypassing user confirmation.

Content

Scanner excerpt · skill.md (reported line 123)May include surrounding context.

md

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The expanded script includes sudo-based package installs for an optional feature. Privileged operations are not inherently malicious, but they are unjustified when bundled into installation for a nonessential dependency.

Content

Scanner excerpt · skill.md (reported line 123)May include surrounding context.

md

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

This line specifically invokes sudo apt install for qrencode, again causing privileged system modification for an optional component. The risk is elevated by the lack of warning and the broad shell script context.

Content

Scanner excerpt · skill.md (reported line 125)May include surrounding context.

md

if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then
    brew install qrencode 2>/dev/null || true
  elif command -v dnf &>/dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

This line invokes sudo dnf install for an optional package, creating the same unnecessary privileged side effect. It broadens the trust required for the skill beyond its advertised purpose.

Content

Scanner excerpt · skill.md (reported line 129)May include surrounding context.

elif command -v brew &>/dev/null; then brew install qrencode 2>/dev/null || true elif command -v dnf &>/dev/null; then sudo dnf install -y qrencode 2>/dev/null || true fi fi

text

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Automatic token detection from a local OpenClaw config is a sensitive capability, but the documentation does not warn users that credentials may be read and then used by a network-exposed service. The absence of disclosure increases the chance of accidental credential exposure or overtrust.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.