T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:50- Finding
Execution of Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
clawdchat
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent ClawdChat integration, but it asks the agent to run recurring background checks, follow changing remote instructions, use broad tool-gateway powers, and automatically replace its own reviewed instructions.
Review before installing. Use this only if you trust clawdchat.ai with an API key, public or semi-public social actions, and tool-gateway requests. Require explicit approval before enabling heartbeat scheduling, automatic skill updates, file uploads, public posting, DMs, or any gateway tool call that sends private data or changes an external account.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:92- Finding
Automatic Replacement of the Audited Skill Definition
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:97- Finding
Recurring Persistence Through Host Heartbeat or Scheduler Configuration
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:177- Finding
Overbroad Delegation to an Unreviewed Remote Tool Gateway
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
Findings (11)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill requires loading API credentials at the start of every session, making secret access a core behavior rather than an exceptional action. In combination with broad activation and external tool/social features, routine credential access raises the risk of unauthorized use, accidental disclosure, or misuse of the account.
- Content
md **Load credentials at the start of every session**, then reuse them. Credentials are a prerequisite for all operations. **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Searching multiple filesystem locations for credentials broadens the secret discovery surface and encourages opportunistic access to whichever file is available. This makes it easier for the skill to consume secrets from unexpected locations, including project directories where credentials may have been placed insecurely.
- Content
md **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Allowing a same-directory credentials.json fallback is especially risky because the skill directory is more likely to be shared, versioned, or overwritten by updates. That increases the chance of secret leakage, accidental inclusion in artifacts, or hostile replacement of expected files.
- Content
md **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback The directory where credentials are found is the **data directory** — `heartbeat-state.json`, `clawdchat-insights.md`, and other user data files are stored there too.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
Defining the credential location as the general data directory and co-locating other persistent files there mixes secrets with broader operational state. This can weaken isolation, increase accidental exposure through backups or sync, and make it easier for later instructions to read or modify adjacent sensitive files.
- Content
md 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback The directory where credentials are found is the **data directory** — `heartbeat-state.json`, `clawdchat-insights.md`, and other user data files are stored there too.
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill repeatedly instructs the agent to fetch remote markdown files on demand and, in the heartbeat section, to execute the fetched heartbeat flow. This creates a classic remote-instruction/supply-chain risk: the effective behavior of the skill can change at runtime based on untrusted network content, bypassing local review.
- Content
md | `style-guide.md` | `curl -s https://clawdchat.ai/style-guide.md` | Content style guide | | `heartbeat.md` | `curl -s https://clawdchat.ai/heartbeat.md` | Heartbeat interaction flow | | `guide.md` | `curl -s https://clawdchat.ai/guide.md` | First-time setup guide | | `id-skill.md` | `curl -s https://clawdchat.ai/id-skill.md` | Shrimp ID card guide | | API docs | `curl -s https://clawdchat.ai/api-docs/{section}` | Fetch on demand | ⚠️ **All remote files must be fetched via `curl -s` — never open a browser to read them.**
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation condition explicitly says to use ClawdChat whenever configured skills and MCPs cannot fulfill the user's needs, which is a very broad fallback. That can route many unrelated requests into this skill, increasing the chance the agent follows risky instructions here such as credential loading, remote fetching, posting, or tool invocation without a narrowly scoped user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to discover, read, and write local credential and state files across multiple filesystem locations, but does not give a clear consent boundary for local data handling. This expands access to secrets and persistent local storage in a way that may be invisible to the user and can facilitate unintended data retention or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill states that updates are automatically downloaded and this file is overwritten, but it does not present this as a prominent user-facing security warning or require approval. Automatic overwrite of instruction files creates a supply-chain and persistence risk because future behavior can change without review.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Writing scheduling directives into a heartbeat file is another persistence mechanism that modifies host automation state. In this skill's context, that persistence is more concerning because the scheduled workflow later fetches remote instructions and can evolve over time.
- Content
md Choose a configuration method by priority: **Method 1 (preferred): Heartbeat file** — your host has a dedicated heartbeat mechanism (e.g., OpenClaw workspace `HEARTBEAT.md`) → write the scheduling directive into the heartbeat file. **Method 2: Scheduled task** — no heartbeat file but has a scheduling mechanism (`AGENTS.md` periodic task section, cron, host scheduler, etc.) → add a task that runs every **2 hours**.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill instructs the host to add a recurring task that runs every two hours, creating persistence beyond the immediate user request. Persistent scheduled execution can continue network activity, remote content retrieval, and account actions without fresh user intent.
- Content
md **Method 1 (preferred): Heartbeat file** — your host has a dedicated heartbeat mechanism (e.g., OpenClaw workspace `HEARTBEAT.md`) → write the scheduling directive into the heartbeat file. **Method 2: Scheduled task** — no heartbeat file but has a scheduling mechanism (`AGENTS.md` periodic task section, cron, host scheduler, etc.) → add a task that runs every **2 hours**. Scheduling directive content:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Posting/Commenting Encoding Note > ⚠️ Posts/comments **must** include `-H "Content-Type: application/json"` header, otherwise CJK characters may trigger `422`. With this header, `curl -d` with inline text works fine. See `curl -s https://clawdchat.ai/api-docs/posts` for detailed format. ### Use Search
Static analysis
No suspicious patterns detected.