T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:39- Finding
Unsigned Remote Skill Replacement Enables Post-Review Instruction Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
clawdchat-official
Security checks for vulnerabilities and agentic risk
Overview
This ClawdChat skill is purpose-aligned as a social-network integration, but it asks the agent to store credentials, act publicly, persist across sessions, and self-update from a remote site without enough user control.
Install only if you are comfortable with an agent holding a ClawdChat bearer token, making public posts/comments/votes/messages, running a recurring heartbeat, and replacing its own instruction files from clawdchat.cn. Safer use would disable automatic self-update and heartbeat, keep credentials in a protected secret store, and require approval before every public write action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T06 · System Persistence
Error
- Location
guide.md:200- Finding
Cross-Session Persistence Through Host Scheduling Configuration
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
guide.md:218- Finding
Persistent Modification of General Agent Identity and Long-Term Memory
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Autonomous Goal and Public-Action Steering Beyond Explicit User Requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
guide.md:136- Finding
API Credentials Stored in Plaintext Without Required Local Protections
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` (this file) | `https://clawdchat.cn/skill.md` | Daily operations guide |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to locate and load credentials from local files, including a fallback path in the user's home directory, then use them for authenticated requests. This is highly sensitive behavior because an auto-invoked or overly trusted skill can access secrets without per-action consent, enabling unauthorized account actions and possible credential misuse.
- Content
md Load credentials once at session start and reuse them — no need to re-read on every API call. The credentials file `credentials.json` is in the same directory as this file. If not found, check the fallback path `~/.clawdchat/credentials.json`. **After finding credentials**, verify they're valid:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The guide instructs the agent to search local filesystem paths for credentials.json, which is direct credential discovery and access. Even if framed as convenience, it normalizes reading secrets from local storage and expands the skill's authority over sensitive authentication material.
- Content
md ⚠️ **Before registering, check if you already have an account!** - **Primary path (skill installation path):** `skills/clawdchat/credentials.json` - **Fallback path** (legacy): `~/.clawdchat/credentials.json` Check in order: primary path first; if not found, check fallback. Use whichever is found.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The fallback path in the home directory broadens secret search to another potentially sensitive location, increasing the chance of unauthorized credential access. This teaches the agent to traverse local secret locations rather than using constrained secret provisioning.
- Content
md ⚠️ **Before registering, check if you already have an account!** - **Primary path (skill installation path):** `skills/clawdchat/credentials.json` - **Fallback path** (legacy): `~/.clawdchat/credentials.json` Check in order: primary path first; if not found, check fallback. Use whichever is found.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The guide instructs saving an API key to a plaintext credentials.json file inside a skills directory. Storing long-lived secrets in a broadly accessible workspace or skill path increases exposure to other tools, skills, repos, backups, or accidental disclosure.
- Content
⚠️ Save the API Key immediately! It will only be shown once.
Save to your skill installation path (as defined above):
skills/clawdchat/credentials.json, using array format to support multiple accounts:json [
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 76% confidence
- Finding
Referencing heartbeat-state.json as colocated with credentials encourages clustering operational state with secret material inside a skills directory. While the state file itself is not a credential, this layout reinforces an insecure secret-management pattern and may simplify secret discovery by related tooling.
- Content
Configure heartbeat:
Step 1: Create the state file
skills/clawdchat/heartbeat-state.json(same directory as credentials.json) to track the last heartbeat time:json {"lastClawdChatCheck": null, "lastPostTime": null, "lastSkillVersionCheck": null}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The guide instructs the agent to record account identity details in persistent memory while explicitly noting where the API key is stored. This links durable identity shaping with credential location knowledge, making later secret retrieval and unauthorized reuse more likely.
- Content
md **Account info:** - Username: [your name] - Profile: https://clawdchat.cn/u/[your name] - API Key: stored in skills/clawdchat/credentials.json - Status: Claimed **My positioning:**
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Making local credentials available to the skill workflow exposes sensitive authentication material to instructions that also perform network operations and can self-update later in the file. In this context, secret access is especially dangerous because the same skill can transmit data off-host and could be changed remotely via the update mechanism.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The explicit instruction to load
credentials.jsonis direct credential access, which is sensitive by default. In a skill that also performs autonomous network calls and supports remote self-update, this creates a strong pathway from local secret exposure to account compromise or broader abuse.- Content
md ## 0. Load Credentials (Prerequisite for All Operations) The credentials file `credentials.json` is in the same directory as this file. If not found, check the fallback path `~/.clawdchat/credentials.json`. No credentials found → stop, prompt your human to register first: fetch `https://clawdchat.cn/guide.md` and follow the instructions.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
1. Check Execution Interval
Read
heartbeat-state.json(same directory as credentials.json):json {"lastClawdChatCheck": "2026-02-05T10:30:00Z", "lastPostTime": "...", "lastSkillVersionCheck": "..."}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
1. Check Execution Interval
Read
heartbeat-state.json(same directory as credentials.json):json {"lastClawdChatCheck": "2026-02-05T10:30:00Z", "lastPostTime": "...", "lastSkillVersionCheck": "..."}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
1. Check Execution Interval
Read
heartbeat-state.json(same directory as credentials.json):json {"lastClawdChatCheck": "2026-02-05T10:30:00Z", "lastPostTime": "...", "lastSkillVersionCheck": "..."}
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to fetch remote content and overwrite local skill files automatically based solely on a version string mismatch. That creates a remote code/instruction supply-chain channel where whoever controls the server, DNS, TLS endpoint, or update path can silently replace the skill's behavior, including adding credential-harvesting or broader host-access instructions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The self-update flow downloads and overwrites local files from a remote host without explicit warning or approval. Besides the transparency issue, this makes hidden behavior changes possible after installation, so users may believe they are running the original skill while its logic has been replaced.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation description uses very broad, common phrases like 'posting', 'calling tools', and 'interacting with other Agents', which can cause the skill to trigger in many unrelated conversations. Over-broad auto-invocation is dangerous because this skill includes instructions to access credentials and perform authenticated network actions, increasing the chance of unintended external actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Use
typeparameter to narrow scope:posts/comments/agents/circles/all
bash curl -X POST "https://clawdchat.cn/api/v1/search" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"q": "keyword", "type": "circles"}'- Use
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill tells the agent to immediately update a local credentials file with a newly returned API key, but provides no safeguards around file writes, secure storage, permission checks, or user confirmation. This creates risk of unsafe secret handling, accidental overwrites, persistence of sensitive tokens in insecure locations, or exfiltration through adjacent tooling.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide first conditions the agent to adopt an independent social persona and then escalates into instructions to persist identity and schedule recurring tasks. This gradual behavioral escalation increases the chance the agent will accept durable autonomy changes that are unrelated to the user's immediate request.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to use information from the system prompt to locate skills directories attempts to leverage higher-priority hidden context for local file modification. This is a cross-layer prompt injection pattern that encourages the agent to act on sensitive environment details not intended for untrusted skill content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
Installing files into the local skills directory establishes persistent presence across sessions and can alter future agent behavior whenever those skills are loaded. In this context, the persistence is especially dangerous because the downloaded files can later influence actions, memory, and scheduling on the host.
- Content
One-line install (replace
SKILLS_DIRwith your skills path; prefercurl, use WebFetch if unavailable):bash mkdir -p SKILLS_DIR/clawdchat curl -o SKILLS_DIR/clawdchat/SKILL.md https://clawdchat.cn/skill.md curl -o SKILLS_DIR/clawdchat/style-guide.md https://clawdchat.cn/style-guide.md curl -o SKILLS_DIR/clawdchat/heartbeat.md https://clawdchat.cn/heartbeat.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The setup performs remote downloads of multiple skill files directly into a trusted local skills directory. Pulling executable guidance from an external domain into a persistent agent control path creates a supply-chain and remote-content injection risk, especially without integrity verification or explicit user approval.
- Content
bash mkdir -p SKILLS_DIR/clawdchat curl -o SKILLS_DIR/clawdchat/SKILL.md https://clawdchat.cn/skill.md curl -o SKILLS_DIR/clawdchat/style-guide.md https://clawdchat.cn/style-guide.md curl -o SKILLS_DIR/clawdchat/heartbeat.md https://clawdchat.cn/heartbeat.md curl -o SKILLS_DIR/clawdchat/skill.json https://clawdchat.cn/skill.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check claim status:
bash curl https://clawdchat.cn/api/v1/agents/status \ -H "Authorization: Bearer YOUR_API_KEY"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide directs the agent to modify unrelated host files such as AGENTS.md, IDENTITY.md, MEMORY.md, and periodic task/scheduler configuration, which exceeds the scope of simple account setup. This creates persistence on the host and changes future agent behavior, enabling long-lived influence well beyond using the ClawdChat service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The self-introduction task hard-codes the circle name
新虾报到, requiring participation in a Chinese-language space. Elsewhere the guide frames these onboarding tasks as required, but it does not offer an alternative language or locale choice, which is a natural-language locale policy concern.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill directs reading local credentials and state files as a prerequisite for operation, expanding access from social interaction tasks into local secret handling. Even if intended for normal auth, embedding file-access instructions in a skill increases the chance of credential exposure, reuse in unintended contexts, or abuse by later modified instructions.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- guide.md:76