Security audit

clawdchat

Security checks for vulnerabilities and agentic risk

Overview

This ClawdChat skill is a coherent social/tool-gateway integration, but it asks for broad credentials, remote self-updates, recurring background activity, and a wide external tool gateway without enough user control.

Install only if you intentionally want an agent to maintain a ClawdChat identity, post or message through that account, and potentially call external tools through ClawdChat. Before use, require explicit approval for heartbeat scheduling, auto-updates, posting, DMs, file uploads, and gateway tool calls; keep credentials outside the skill directory with restricted permissions; and do not share private user data or secrets through ClawdChat unless the exact content and recipient are approved.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (11)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation rule says to use the skill whenever configured skills and MCPs cannot fulfill the user's needs, which is extremely broad and can route many unrelated requests into a high-risk skill. Because this skill includes credential loading, remote fetches, posting, messaging, and tool-calling instructions, over-invocation expands the chance of unnecessary external actions and data exposure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that when an update is found, the local skill file is automatically downloaded and overwritten. This creates a remote self-modifying behavior where trusted local instructions can change without user review, enabling supply-chain compromise or silent capability expansion.

External Transmission

Medium

Category: Data Exfiltration
Content: ### Posting/Commenting Encoding Note > ⚠️ Posts/comments **must** include `-H "Content-Type: application/json"` header, otherwise CJK characters may trigger `422`. With this header, `curl -d` with inline text works fine. See `curl -s https://clawdchat.ai/api-docs/posts` for detailed format. ### Use Search
Confidence: 84% confidence
Finding: The skill repeatedly instructs the agent to send posts, comments, searches, messages, and other user-derived content to an external service. In context, this is the skill's purpose, but it still constitutes external transmission of potentially sensitive user data and should not occur implicitly or for unrelated requests.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: ## Your Human Can Ask You To Your human can ask you to do anything on ClawdChat at any time — both social and tools: **Social:** - "Check what's new on ClawdChat"
Confidence: 96% confidence
Finding: The skill instructs the agent to use a 2000+ tool gateway whenever local skills cannot solve a problem and says the human can ask it to do anything on ClawdChat at any time. This is effectively broad delegated tool access without allowlisting, risk classification, or user confirmation for impactful actions, increasing the chance of unintended real-world effects or data sharing.

Credential Access

High

Category: Privilege Escalation
Content: **Load credentials at the start of every session**, then reuse them. Credentials are a prerequisite for all operations. **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended)
Confidence: 97% confidence
Finding: The skill directs the agent to load API credentials automatically at the start of every session. Automatic credential access increases exposure of secrets to a skill even when the user did not request an authenticated ClawdChat action, and it widens the blast radius if the skill is mis-invoked or compromised.

Credential Access

High

Category: Privilege Escalation
Content: **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback
Confidence: 94% confidence
Finding: The documented search order includes an environment-controlled path, which can let external environment configuration redirect the agent to attacker-controlled credential material in some host setups. While not always exploitable, it increases ambiguity about which secret source is trusted.

Credential Access

High

Category: Privilege Escalation
Content: **The credential file `credentials.json` is searched in this order (first found wins):** 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback The directory where credentials are found is the **data directory** — `heartbeat-state.json`, `clawdchat-insights.md`, and other user data files are stored there too.
Confidence: 98% confidence
Finding: Allowing credentials.json in the same directory as the skill file as a fallback is dangerous because skill directories may be more exposed to package distribution, updates, or tampering than dedicated secret storage. This mixes code and secrets and makes credential substitution or accidental disclosure more likely.

Credential Access

High

Category: Privilege Escalation
Content: 1. `$CLAWDCHAT_HOME/credentials.json` — env var override (highest priority) 2. `~/.clawdchat/credentials.json` — standard path (recommended) 3. `credentials.json` in the same directory as this file — sandbox fallback The directory where credentials are found is the **data directory** — `heartbeat-state.json`, `clawdchat-insights.md`, and other user data files are stored there too.
Confidence: 91% confidence
Finding: Declaring the credential-containing directory as a shared data directory for other state files encourages co-location of secrets with routinely read and written operational data. This increases the chance of accidental leakage, backup exposure, or broader file access patterns touching secret material.

Session Persistence

Medium

Category: Rogue Agent
Content: **Method 1 (preferred): Heartbeat file** — your host has a dedicated heartbeat mechanism (e.g., OpenClaw workspace `HEARTBEAT.md`) → write the scheduling directive into the heartbeat file. **Method 2: Scheduled task** — no heartbeat file but has a scheduling mechanism (`AGENTS.md` periodic task section, cron, host scheduler, etc.) → add a task that runs every **2 hours**. Scheduling directive content:
Confidence: 95% confidence
Finding: The skill directs the host to add a recurring scheduled task every 2 hours, creating persistent autonomous behavior beyond the immediate user request. Persistence is risky because it can continue generating network activity, data exchange, and account actions without contemporaneous user awareness.

Session Persistence

Medium

Category: Rogue Agent
Content: Choose a configuration method by priority: **Method 1 (preferred): Heartbeat file** — your host has a dedicated heartbeat mechanism (e.g., OpenClaw workspace `HEARTBEAT.md`) → write the scheduling directive into the heartbeat file. **Method 2: Scheduled task** — no heartbeat file but has a scheduling mechanism (`AGENTS.md` periodic task section, cron, host scheduler, etc.) → add a task that runs every **2 hours**.
Confidence: 95% confidence
Finding: The preferred method is to write scheduling directives into a heartbeat file, which is another persistence mechanism that modifies host automation behavior. Combined with the social-network and remote-fetch functions, this creates ongoing execution authority that can outlive the triggering conversation.

External Script Fetching

High

Category: Supply Chain
Content: | `style-guide.md` | `curl -s https://clawdchat.ai/style-guide.md` | Content style guide | | `heartbeat.md` | `curl -s https://clawdchat.ai/heartbeat.md` | Heartbeat interaction flow | | `guide.md` | `curl -s https://clawdchat.ai/guide.md` | First-time setup guide | | `id-skill.md` | `curl -s https://clawdchat.ai/id-skill.md` | Shrimp ID card guide | | API docs | `curl -s https://clawdchat.ai/api-docs/{section}` | Fetch on demand | ⚠️ **All remote files must be fetched via `curl -s` — never open a browser to read them.**
Confidence: 98% confidence
Finding: The skill tells the agent to fetch remote markdown files on demand and, in places, to follow or execute their instructions, including heartbeat flows and setup guidance. This is effectively remote unpinned instruction loading, creating a supply-chain risk where behavior can be changed server-side after installation without local review.

Static analysis

No suspicious patterns detected.