Migrate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

This migration skill does what it says, but it moves live session data and can restore archive-controlled skills and configuration into trusted Clawdbot locations without enough safeguards.

Install only if you understand that exports may contain active WhatsApp session data, private workspace files, managed skills, transcripts, and optionally credentials. Treat created archives like secrets, avoid cloud/shared storage unless protected, and only import archives you created and trust; importing someone else's archive could change your Clawdbot skills or configuration.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/import.sh:59

Finding

Unauthenticated Archives Can Install Attacker-Controlled Skills and Configuration

Content

View full analysis

/dev/null || true echo -e " ${GREEN}✓${NC} Workspace restored" fi # Restore config if [ -d "$STAGING/config" ]; then echo -e "${YELLOW}→ Restoring config to $CONFIG_DIR...${NC}" mkdir -p "$CONFIG_DIR" # Main config if [ -f "$STAGING/config/clawdbot.json" ]; then cp "$STAGING/config/clawdbot.json" "$CONFIG_DIR/" echo -e " ${GREEN}✓${NC} Config file restored" fi # Skills if [ -d "$STAGING/config/skills" ]; then cp -r "$STAGING/config/skills" "$CONFIG_DIR/" echo -e " ${GREEN}✓${NC} Managed skills restored" fi # WhatsApp session if [ -d "$STAGING/config/whatsapp" ]; then cp -r "$STAGING/config/whatsapp" "$CONFIG_DIR/" echo -e " ${GREEN}✓${NC} WhatsApp session restored" fi # Sessions (if included) if [ -d "$STAGING/config/agents" ]; then cp -r "$STAGING/config/agents" "$CONFIG_DIR/" echo -e " ${GREEN}✓${NC} Session transcripts restored" fi # Credentials (if included) if [ -d "$STAGING/config/credentials" ]; then cp -r "$STAGING/config/credentials" "$CONFIG_DIR/" echo -e " ${GREEN}✓${NC} Credentials restored" fi fi ``` ### Technical Analysis The importer accepts any local gzip-compresse ...[truncated 2286 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export.sh:95

Finding

Sensitive Authentication State Is Exported Without Enforced Confidentiality

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/export.sh (reported line 81)May include surrounding context.

sh

cp -r "$WORKSPACE"/* "$STAGING/workspace/" 2>/dev/null || true

# Cleanup if rsync wasn't available
rm -rf "$STAGING/workspace/.git" "$STAGING/workspace/node_modules" "$STAGING/workspace/.next" 2>/dev/null || true

echo -e "${YELLOW}→ Staging config...${NC}"
mkdir -p "$STAGING/config"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Exporting WhatsApp session state by default without explicit consent or a high-visibility warning is dangerous because the archive becomes a portable container for active authentication artifacts. If copied, uploaded, or restored on an untrusted system, an attacker could potentially reuse that session and compromise messaging access.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/import.sh (reported line 33)May include surrounding context.

sh

echo ""
            echo "Options:"
            echo "  --workspace PATH       Target workspace directory (default: ~/clawd)"
            echo "  --force, -f            Overwrite existing files without prompting"
            exit 0
            ;;
        *)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

WhatsApp session data is exported by default, while the manifest model distinguishes optional session-like content and the skill context implies users may not expect active session tokens to be migrated automatically. Silent inclusion of session state can enable unintended account takeover or exposure if the archive is accessed by another party.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script always copies $HOME/.clawdbot/whatsapp into the export archive whenever that directory exists, even though other sensitive data classes are gated behind flags and the skill description says such data is optional. This creates a privacy and account-security issue because authentication/session material is silently bundled into a portable archive that may be shared or stored insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script produces a portable tar.gz containing workspace files, configuration, skills, and potentially session or credential material, but it gives no prominent warning at archive creation time about handling sensitive contents. In a migration/backup skill, users are especially likely to move archives across machines or cloud storage, increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script restores WhatsApp sessions, agent transcripts, and credentials from an archive without a clear upfront warning or confirmation specifically about sensitive data import. In a migration tool, this can cause users to unknowingly import secrets or active session material from an untrusted or stale backup, increasing the risk of account takeover, secret exposure, or operational confusion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.