Clawhub Skill Bandwidth Income

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:45 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for bandwidth-income nodes, but it asks users to run persistent network-relay containers with sensitive access and insufficient safety scoping.

Review this carefully before installing. Use only dedicated, isolated hosts or VLANs, verify platform terms and ISP rules, avoid reused credentials, do not expose management ports publicly, prefer pinned and verified container images, and understand that abuse complaints or traffic reputation issues may trace back to your IP.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:82

Finding

Unverified Mutable Third-Party Container Image Receives Account Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:139

Finding

Platform Passwords Exposed Through Container Environment Variables

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:103

Finding

Mysterium Management Dashboard Published on All Host Interfaces Without Transport Protection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Mysterium instructions do not prominently warn that the host becomes a VPN exit node, meaning third-party traffic may appear to originate from the user's public IP. In this specific skill that is highly dangerous because it can create abuse complaints, legal exposure, reputation damage, and increased attack surface while encouraging non-expert users to deploy it quickly.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Granting NET_ADMIN gives the container powerful control over networking, including interface, routing, firewall, and packet-handling changes. Even if required for legitimate VPN functionality, this materially increases the blast radius of a compromised or malicious container and is especially risky here because the skill also uses third-party images and exposes the service to external traffic.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

docker run -d \
  --name mysterium-node \
  --restart unless-stopped \
  --cap-add NET_ADMIN \
  -p 4449:4449 \
  -v ~/.mysterium:/root/.mysterium \
  mysteriumnetwork/myst:latest \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The examples encourage setup and restart operations for bandwidth-sharing nodes without clearly foregrounding that these actions deploy third-party containers and may expose services or route external traffic through the user's IP. That omission increases the chance that users execute risky commands without understanding the legal, privacy, and security consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run third-party Docker images using mutable tags instead of pinned digests, which allows image contents to change over time without review. In this context the risk is amplified because the containers handle credentials, networking, and potentially route third-party traffic, so a compromised or swapped image could execute arbitrary code or exfiltrate secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This deployment runs a network-facing VPN node from an unpinned image, so future pulls may introduce malicious or unsafe changes without the user's knowledge. Because the container also requests elevated networking capability and exposes a management port, a malicious image could have significant host and network impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The Storj node is deployed from an image reference that is not immutably pinned, creating supply-chain risk if the image is changed upstream or the registry account is compromised. Since the container stores wallet, email, public IP, and persistent data, compromise could lead to credential theft, data tampering, or abuse of exposed services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.