ClawHub
Back to skill

Security audit

Clawhub

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about renting and operating cloud servers, but it can spend wallet funds and perform high-impact server actions without strong approval guidance.

Install only if you are comfortable letting an agent use a funded wallet and an AgentMetal account key to rent, extend, operate, and destroy servers. Use a dedicated low-balance wallet, set tight spend limits such as AGENTMETAL_MAX_USDC, avoid exposing long-lived keys in logs or prompts, and require human approval before paid, root exec, reboot, or destroy actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
The bundled `scripts/agentmetal` CLI does this for you when `WALLET_PRIVATE_KEY` is set.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
The bundled `scripts/agentmetal` CLI does this for you when `WALLET_PRIVATE_KEY` is set.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The skill exposes a direct destructive operation (DELETE /v1/servers/{id}) that can irreversibly terminate infrastructure, and the documentation does not require an explicit confirmation guardrail beyond possession of an API key. In an autonomous-agent setting, parameter abuse or prompt manipulation could cause accidental or unauthorized deletion of active systems and data loss.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

POST /v1/servers/{id}/extend { "days": 7 } → 200 { …, expires_at }

Destroy early (requires an account API key: Authorization: Bearer am_live_…)

DELETE /v1/servers/{id} → 200 { id, status: "destroyed" }

text

Paid calls (`/v1/servers`, `/extend`) all use the same 402 → pay → resend dance shown above.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly expects network access and use of sensitive environment variables such as WALLET_PRIVATE_KEY and AGENTMETAL_API_KEY, but it declares no explicit tool scope or permission boundaries. That increases the chance an agent will use broader-than-necessary capabilities without clear user consent or sandbox restrictions, especially given the skill can spend funds and provision infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Browse the catalog (free, no payment, no account)

bash
curl https://api.agentmetal.dev/v1/catalog
  → { plans: [...], locations: [...], addons: { storage, bandwidth } }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Browse the catalog (free, no payment, no account)

bash
curl https://api.agentmetal.dev/v1/catalog
  → { plans: [...], locations: [...], addons: { storage, bandwidth } }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Browse the catalog (free, no payment, no account)

bash
curl https://api.agentmetal.dev/v1/catalog
  → { plans: [...], locations: [...], addons: { storage, bandwidth } }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Browse the catalog (free, no payment, no account)

bash
curl https://api.agentmetal.dev/v1/catalog
  → { plans: [...], locations: [...], addons: { storage, bandwidth } }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

Browse the catalog (free, no payment, no account)

bash
curl https://api.agentmetal.dev/v1/catalog
  → { plans: [...], locations: [...], addons: { storage, bandwidth } }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises root command execution and destructive operations such as reboot and delete without requiring an explicit risk acknowledgment or strong user-approval checkpoint. In an agent context, that makes it easy to turn a natural-language prompt into high-impact infrastructure changes, service disruption, or irreversible deletion.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The example command uses an unpinned container image (docker run -d nginx), which pulls a mutable latest tag. This can lead to non-reproducible deployments and accidental execution of a changed or compromised upstream image as root on the provisioned server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs use of highly sensitive credentials, including a wallet private key and API keys, without explicit secret-handling guidance. In an agent workflow, this raises the risk of credential leakage through logs, prompts, shell history, error messages, or transmission to unintended tools or services.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:91