ClawHub
Back to skill

Security audit

ANSIClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is an ANSI-art tool, but its bundled scripts can write fixed output files to Desktop/Documents without collision checks or clear user control.

Review before installing. The skill's local Clawbius API use is expected, but only run scripts you recognize and confirm output paths first. Watch for files named `monarch_butterfly`, `field`, or `flower_v2` on Desktop/Documents because reruns may overwrite those outputs. Prefer changing scripts to save into the skill's output folder with versioned filenames.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/draw_butterfly.py:313
Finding

Butterfly Script Can Overwrite Fixed Desktop Output Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/draw_field.py:193
Finding

Field Script Can Overwrite Fixed Desktop Output Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/flower_v2.py:290
Finding

Flower Script Uses Fixed Output Names Without Collision Protection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger guidance says to use the skill anytime the user asks for ANSI art, or when the agent wants to create it on its own initiative. Self-initiated activation materially increases risk because the skill can perform file and local API operations without a tightly scoped user request, making unintended actions more likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs the agent to make network requests to a local REST API, but the manifest declares no explicit tool scope or permission boundary. That mismatch creates an undeclared capability path where an agent may perform networked actions without clear policy constraints or user visibility, increasing the chance of misuse or overreach.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

python
import requests, json
# Open the reference file
requests.post("http://127.0.0.1:7777/api/file/open",
    json={"path": "/absolute/path/to/resources/file.ans"})

# Get canvas info

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

python
import requests, json
# Open the reference file
requests.post("http://127.0.0.1:7777/api/file/open",
    json={"path": "/absolute/path/to/resources/file.ans"})

# Get canvas info

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
93% confidence
Finding

The skill performs HTTP requests to an internal loopback service and passes a filesystem path into that service's file-open endpoint. Even though the host is 127.0.0.1, this still exposes an internal request surface that can be abused to access or manipulate local resources through the API if the agent is induced to use attacker-chosen paths.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

python
import requests, json
# Open the reference file
requests.post("http://127.0.0.1:7777/api/file/open",
    json={"path": "/absolute/path/to/resources/file.ans"})

# Get canvas info

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
json={"path": "/absolute/path/to/resources/file.ans"})

# Get canvas info
info = requests.get("http://127.0.0.1:7777/api/canvas/info").json()

# Get full canvas data and analyze color/code usage
data = requests.get("http://127.0.0.1:7777/api/canvas/data").json()

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
json={"path": "/absolute/path/to/resources/file.ans"})

# Get canvas info
info = requests.get("http://127.0.0.1:7777/api/canvas/info").json()

# Get full canvas data and analyze color/code usage
data = requests.get("http://127.0.0.1:7777/api/canvas/data").json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The generic helper posts arbitrary JSON to arbitrary API paths on the configured local service, creating a broad action surface for state-changing operations. In a skill that can be triggered too broadly, this abstraction makes it easier for the agent to invoke unintended endpoints or destructive actions without granular safeguards.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md
BASE = "http://127.0.0.1:7777"

def post(path, data):
    r = requests.post(f"{BASE}{path}", json=data)
    resp = r.json()
    if not resp.get("ok"): print(f"WARN {path}: {resp}")
    return resp

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented API exposes file-writing operations such as save-as and export to arbitrary absolute paths, which can modify local files if an agent uses them on untrusted or ambiguous user input. In an agent skill context, this is dangerous because the documentation normalizes these capabilities without any safety guidance, increasing the chance that automation will overwrite user files or write to sensitive locations on the host.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The instruction to 'run any script' encourages unrestricted execution of local tool-capable Python files from the skill directory. In an agent context, this reduces friction for arbitrary code execution and can amplify the effects of any unsafe script behavior such as filesystem writes or local API abuse.

Content

Scanner excerpt · scripts/README.md (reported line 5)May include surrounding context.

Python scripts that draw ANSI art via the Clawbius API. Each script is self-contained and re-runnable.

To run any script, just ask Clawd — or run directly:

text
python3 ~/.openclaw/workspace/skills/ANSIClaw/scripts/<script_name>.py

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README tells users to 'run any script' or 'just ask Clawd' without constraining which script may be executed or warning that execution runs local Python code. Broad invocation guidance can lead users or an agent to execute arbitrary scripts in the skill directory without review, increasing the chance of unintended code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README states that output files are written to '~/Documents/ANSIClaw Output/' but does not present this as a user-facing warning or ask for consent. Silent writes to a user's Documents folder can cause privacy surprises, clutter trusted storage locations, and overwrite or create files in a location users may not expect a skill to modify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README notes that scripts use 'requests' to call a local API at 'http://127.0.0.1:7777' but does not clearly warn users that execution performs HTTP requests. Even though the destination is localhost, local services can expose privileged functionality, and users should be informed that running the scripts will interact with another process over the network stack.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script writes files directly to the user's Desktop without prompting, which can create unwanted side effects and overwrite expectations about where data is stored. Although the filenames are fixed and the content is benign art output, silent writes to a user-visible location are risky behavior for an agent skill because they bypass user consent and could expose generated content to others with access to the desktop.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill draws BBS-compatible ANSI art via the Clawbius API, which aligns with creating ANSI canvas content and saving an .ans file. The code additionally invokes a PNG export operation, producing a non-ANSI derivative artifact that goes beyond the described ANSI-only scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script unconditionally writes output files to ~/Desktop, which modifies the user's filesystem without consent or configurability. While the files are benign image/art outputs in this context, unexpected writes can overwrite existing files, leak activity, or violate user expectations in an agent-executed environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/draw_butterfly.py (reported line 30)May include surrounding context.

python
BASE = "http://127.0.0.1:7777"

def post(path, data):
    r = requests.post(f"{BASE}{path}", json=data)
    resp = r.json()
    if not resp.get("ok"):
        print(f"WARN {path}: {resp}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/draw_field.py (reported line 11)May include surrounding context.

python
BASE = "http://127.0.0.1:7777"

def post(path, data):
    r = requests.post(f"{BASE}{path}", json=data)
    resp = r.json()
    if not resp.get("ok"):
        print(f"WARN {path}: {resp}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/flower_v2.py (reported line 6)May include surrounding context.

python
BASE = "http://127.0.0.1:7777"

def post(path, data):
    r = requests.post(f"{BASE}{path}", json=data)
    resp = r.json()
    if not resp.get("ok"):
        print(f"WARN {path}: {resp}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script writes output files directly into the user's Documents directory and performs export actions without any prompt, confirmation, or configurable destination. In an agent-skill context, silent filesystem writes are risky because execution has side effects outside the immediate drawing task and can surprise users or overwrite expected artifacts if naming collides.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/flower_v2.py (reported line 297)May include surrounding context.

python
post("/api/file/save", {"path": ans_path})

r = requests.post(f"{BASE}/api/file/export/png", json={"path": png_path})
print("PNG export:", r.text[:80])
print(f"Saved: {ans_path}")
print("ALL DONE ✓")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The open-file endpoint accepts arbitrary absolute local paths, enabling reads of local files if an agent is induced to call it with attacker-influenced input. While this is an API reference rather than executable code, documenting the capability without warning makes misuse more likely in an automated skill that may access host-local resources.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README first says reference files can be analyzed with a Peekaboo screenshot, but later instructs users not to use Peekaboo because it captures the wrong window. These instructions actively conflict and create ambiguity about the intended analysis method.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends HTTP requests to a local service on 127.0.0.1:7777 without any upfront disclosure to the user. Even though the target is localhost rather than an external host, undisclosed network interaction in a skill is still security-relevant because it depends on another process, may trigger unintended actions, and could interact with a different service if that port is occupied by something else.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.