ClawHub
Back to skill

Security audit

ClawDirect

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for ClawDirect use, but it teaches users to handle an auth cookie through a URL and repeatedly run unpinned npx commands in authenticated and paid workflows.

Review before installing. Prefer pinned, reviewed versions of the ATXP tooling instead of copy-pasting unpinned npx commands, and avoid putting the ClawDirect auth cookie in a URL unless you accept the chance it may be recorded in browser history, logs, or monitoring systems. Use direct cookie setting or a more secure auth exchange when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Packages Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–13; repeated at lines 21, 37, 93, and 115
Vulnerability Type: Supply-chain exposure through dynamically resolved dependencies
Risk Level: Medium

Vulnerable Code:

bash
npx skills add atxp-dev/cli --skill atxp
npx atxp-call https://claw.direct/mcp <tool_name> [params]

Technical Analysis

The skill instructs users or agents to execute npm-resolved command-line packages without specifying exact versions, integrity hashes, a lockfile, or immutable source revisions. When a package is unavailable locally, npx may retrieve and execute the version selected by the package registry at invocation time.

The skills add atxp-dev/cli operation also imports externally maintained skill content without pinning it to a reviewed commit. Consequently, the code executed during future invocations can differ from the content that was originally reviewed. This creates a supply-chain trust dependency on the npm registry, package maintainers, repository maintainers, and their accounts.

Attack Path

  1. An attacker compromises the publishing account, package, repository, or distribution infrastructure associated with one of the referenced tools.
  2. The attacker publishes a malicious version or modifies externally retrieved skill content.
  3. An agent follows the documented Quick Start or another workflow and invokes the unpinned package through npx.
  4. npx dynamically retrieves and executes the attacker-controlled release.
  5. The malicious package runs with the operating-system permissions and accessible environment of the invoking user or agent.
  6. It may read accessible credentials, including ATXP-related authentication material, alter local files, or initiate unauthorized network and paid MCP operations.

Impact Assessment

Successful exploitation can provide arbitrary code execution within the invoking process's user-level privileges. Th ...[truncated 339 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every npm dependency to an exact, reviewed version rather than relying on registry-selected versions.
  • Pin externally imported skill content to an immutable commit hash.
  • Provide and verify a lockfile and package integrity hashes.
  • Install reviewed dependencies once and invoke their local pinned binaries instead of dynamically downloading packages with npx.
  • Document the expected package publisher, checksum, release signature, and verification procedure.
  • Run the tooling in a sandbox with minimal filesystem, credential, environment-variable, and network access.
  • Require explicit confirmation before paid MCP calls and avoid exposing unrelated credentials to the tool process.
  • Establish a dependency-update review process that examines source and provenance before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Authentication Cookie Transported in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–62
Vulnerability Type: Sensitive authentication material exposed through URL-based transport
Risk Level: Medium

Vulnerable Code:

text
The cookie is HTTP-only. If you're using a browser, navigate to the site with the cookie in the query string:

https://claw.direct?clawdirect_cookie=<cookie_value>

The server will:
1. Set the HTTP-only cookie for you
2. Redirect to clean the URL (removing the cookie value from the address bar)

After this redirect, your browser session is authenticated and you can interact with the site normally.

Technical Analysis

The workflow places a bearer-like authentication credential in a URL query parameter. Although the server reportedly redirects the browser to a clean URL, the credential has already been included in the original HTTP request URL.

Query strings can be captured by browser history, server or reverse-proxy access logs, CDN and monitoring infrastructure, debugging tools, screenshots, telemetry, and URL-observing browser components. Depending on browser and response behavior, the URL may also be exposed through referrer handling. Marking the resulting cookie as HttpOnly does not protect the credential while it is present in the URL; HttpOnly only restricts script access after the value has been installed as a cookie.

Attack Path

  1. An authenticated agent obtains a clawdirect_cookie value through the documented MCP tool.
  2. The agent opens the documented URL containing the credential in its query string.
  3. A browser component, intermediary, access log, telemetry platform, monitoring system, or person with access to browser history records or observes the original URL.
  4. An attacker obtains the recorded query parameter.
  5. The attacker sets or submits the stolen cookie value to claw.direct.
  6. If the token remains valid and is reusable, the attacker performs operations av ...[truncated 630 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place session cookies or reusable bearer credentials in URL query parameters.
  • Prefer direct secure-cookie installation through an approved browser or automation API.
  • If browser-based exchange is necessary, use a short-lived, single-use authorization code rather than the final session credential.
  • Bind the exchange code to the initiating client and invalidate it immediately after successful redemption.
  • Set the resulting cookie with Secure, HttpOnly, and an appropriately restrictive SameSite policy.
  • Use short expiration periods, credential rotation, server-side revocation, and replay detection.
  • Redact query strings from application, proxy, CDN, analytics, and monitoring logs.
  • Apply a strict referrer policy such as Referrer-Policy: no-referrer during any transitional exchange flow.
  • Ensure error pages and redirects never reproduce sensitive values in response content or redirect destinations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs users to run npx skills add atxp-dev/cli --skill atxp without pinning an exact package version. This creates a supply-chain risk because future package updates or dependency compromise could cause different code to execute than the reviewer expected.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill recommends invoking npx atxp-call https://claw.direct/mcp <tool_name> [params] without pinning the atxp-call package version. Because npx fetches and executes packages dynamically, a compromised or changed upstream package could execute arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This repeated npx atxp-call example also omits version pinning, preserving the same remote package execution risk. Repetition across the skill increases the likelihood that users will follow the unsafe pattern directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The unauthenticated package execution pattern appears again when retrieving the auth cookie via npx atxp-call. Since this command is used in an authentication workflow, users may run it with elevated trust, making supply-chain compromise especially concerning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill tells users to place an authentication cookie into the URL query string so the server can set it, but URLs are commonly exposed through browser history, logs, referrer headers, screenshots, proxies, and analytics tooling. Even if the server later redirects, the secret may already have been recorded or leaked, making this a significant credential exposure risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The clawdirect_add example uses unpinned npx atxp-call, again exposing users to execution of whatever package version is current at runtime. This is a standard but real supply-chain weakness in security-sensitive workflow documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The edit workflow repeats the same unpinned npx atxp-call usage, so the risk remains unchanged. Since this command can modify remote content on behalf of the authenticated user, a malicious package could abuse local credentials or alter requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.