ClawHub
Back to skill

Security audit

Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about autonomous bounty activity, but it asks users to enable ongoing external actions and wallet-backed staking with insufficient safeguards around private keys and consent.

Review this carefully before installing. Use only dedicated low-balance accounts and wallets, prefer proposal-only mode, avoid storing any real wallet private key in a config file, and do not enable autonomous mode unless you are comfortable with repeated third-party platform activity and possible staking actions on your behalf.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:75
Finding

Plaintext Wallet Private Key Stored in File-Based Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:75-84
Vulnerability Type: Plaintext sensitive credential configuration
Risk Level: High

Vulnerable Code

json
{
  "clawtasks": {
    "enabled": true,
    "clawtasksApiKey": "your_clawtasks_key",
    "openworkApiKey": "ow_your_openwork_key",
    "walletPrivateKey": "0x...",
    "autonomousMode": true,
    "pollIntervalMinutes": 30,
    "preferProposalMode": true,
    "maxStakePercent": 20
  }
}

Technical Analysis

The documented configuration places a cryptocurrency wallet private key directly in a file-based configuration field named walletPrivateKey. Users following this example may save an actual private key in a plaintext JSON file.

Configuration files can be exposed through accidental source-control commits, unencrypted backups, support bundles, diagnostic collection, filesystem permission errors, or access by another local process. Unlike a revocable API token, compromise of a wallet private key generally gives the holder cryptographic authority over the corresponding wallet.

The configuration also enables autonomousMode and permits staking up to the configured percentage. This increases the sensitivity of the credential because the documented workflow anticipates using it for financial transactions. The project contains only documentation, so the claimed key redaction, contract validation, approval limits, and transaction controls cannot be verified from an implementation.

Attack Path

  1. A user follows the documented example and inserts a real wallet private key into the JSON configuration.
  2. The configuration is accidentally committed, included in a backup or diagnostic archive, read by another local process, or exposed due to permissive filesystem access.
  3. An attacker extracts the value of walletPrivateKey.
  4. The attacker imports the key into a wallet or signing utility.
  5. The attacker signs unauthoriz ...[truncated 762 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove walletPrivateKey from the file-based configuration schema and documentation.
  • Use an operating-system credential store, managed secret service, hardware wallet, or isolated signing service.
  • Prefer transaction signing through a wallet interface that requires explicit authorization rather than exposing raw key material to the agent.
  • If environment injection remains supported, provide the secret only to the process that requires it and ensure it is excluded from logs, crash reports, process diagnostics, and child-process environments.
  • Enforce restrictive permissions on any unavoidable local secret files and prevent their inclusion in source control and backups.
  • Use a dedicated wallet containing only the minimum funds required for the task.
  • Apply transaction-level controls, including destination contract allowlists, chain-ID verification, exact approval amounts, spending ceilings, expiration times, and human confirmation for high-value operations.
  • Add automated secret scanning and tests confirming that private keys are never persisted or logged.
  • Document immediate key rotation and asset migration procedures for suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill prominently advertises autonomous earning and a 'set it and forget it' workflow, including polling, proposal generation, and platform interaction, but it does not present a clear upfront warning that enabling the skill can cause ongoing external activity and automatic submissions on the user's behalf. This can lead users to authorize behavior with financial, reputational, or rate-limit consequences without fully informed consent, especially because the skill also supports staking and wallet-based actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.