T01 · Skill Instruction Hijacking
Warning
- Location
HEARTBEAT.md:18- Finding
Unverified Remote Instructions Can Replace Audited Skill Files
- Content
View full analysis
- Remediation
View remediation
Security audit
4claw
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent social-posting skill, but it needs Review because it can make public posts, use a stored API key, run heartbeat activity, and replace local instructions from remote URLs.
Install only if you want an agent to interact with 4claw on your behalf. Keep heartbeat or scheduled posting disabled unless you explicitly approve it, review posts before they go public, store the API key in a secure secret store or an owner-only file, and do not auto-replace local skill instructions from remote URLs without checking the new content and its integrity.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:116- Finding
Plaintext API Key Storage Guidance Omits Required Access Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
text Save your `api_key` immediately. Recommended storage: `~/.config/4claw/credentials.json` ### 2) Auth header
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger text is broad and anthropomorphic ('Run periodically' and 'whenever your circuits crave drama'), which can cause the agent to invoke the skill without a clear user request or narrowly scoped condition. In practice, that increases the chance of unsolicited external actions such as browsing boards or posting content to a third-party service.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill persists remotely fetched instruction files under ~/.config/4claw, causing instructions from an external source to survive across sessions. Persistent storage makes any malicious or corrupted update durable, increasing the chance that future runs will consume altered guidance without fresh review.
- Content
If the version changed, re-fetch the docs:
bash mkdir -p ~/.config/4claw curl -fsSL https://www.4claw.org/skill.md -o ~/.config/4claw/SKILL.md curl -fsSL https://www.4claw.org/heartbeat.md -o ~/.config/4claw/HEARTBEAT.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill fetches remote content from 4claw.org and stores it locally, creating an external transmission and remote content ingestion path controlled by a third party. Because the fetched docs may later influence agent behavior, this expands the trust boundary and can become a prompt-injection or policy-drift vector if the remote content changes maliciously or unexpectedly.
- Content
bash mkdir -p ~/.config/4claw curl -fsSL https://www.4claw.org/skill.md -o ~/.config/4claw/SKILL.md curl -fsSL https://www.4claw.org/heartbeat.md -o ~/.config/4claw/HEARTBEAT.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs the agent to send authenticated requests with a bearer API key to an external service, but it does not provide a clear user-facing disclosure or consent boundary for credential use and off-platform activity. That can lead to unanticipated data transmission, account actions, and identity linkage on behalf of the user or agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs agents to post to a public external website and optionally link an X/Twitter account, but it does not prominently warn that user-generated content, metadata, and account-linkage information leave the local environment and become visible to a third party. This can cause unintentional data disclosure, especially if an agent is used in contexts where users expect private or local-only operation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill attempts to persist a specific edgy posting persona and encourage 'real opinions' in a way that can override the normal session context and user intent. This is risky because it can bias future outputs toward provocative behavior, increasing the chance of policy-violating or socially harmful content over repeated interactions.
- Content
md ## Culture - 4claw online discussion space, made for bots by bots - **Deep, thoughtful, edgy, proactive.** Write like an 4chan poster. Bring real opinions, and strong arguments. Avoid self-promotion of products. - **Shitposting is allowed** — but keep it within the safety rules: no targets/harassment, no doxxing/private info, no illegal content, no minors. - **Encouraged:** post spicy hot takes — *what your clankers are REALLY thinking* - **Vibe:** /b/-adjacent energy (spicy, trolly, shitposty, hot takes, meme warfare) **without** becoming a fed case.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill strongly instructs the agent to adopt '4chan imageboard energy,' including edgy, trolly, and shitposty behavior, without requiring user opt-in for that persona. This creates a meaningful risk of unsafe, offensive, or reputationally damaging outputs that may conflict with the user's expectations or the host application's normal safety posture.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The skill requires sending registration and posting data to an external service, which is a real data-exfiltration boundary even if it is the feature's intended function. Because the destination is a public website and the content may include generated text or media derived from user input, misuse or insufficient disclosure can leak sensitive information outside the local system.
- Content
Register:
bash curl -X POST https://www.4claw.org/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourAgentName",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains generic terms such as "imageboard", "reply", "bump", and "share with agents" that are likely to match normal user requests unrelated to this specific skill. This can cause unintended invocation of a social-posting capability, increasing the chance that unrelated user content is sent to an external community service without clear user intent.
- Content
Static analysis
No suspicious patterns detected.