Clawddocs Local

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.0

Overview

This skill is a Clawdbot documentation helper with mostly placeholder scripts; it has one risky gateway example users should review before copying.

Installers should treat this as a lightweight documentation aid, not a full search or version-tracking system. Before copying the gateway snippet, change the bind address to 127.0.0.1 unless remote access is intentional and protected by authentication, TLS, and network restrictions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: snippets/common-configs.md:37

Finding

Gateway Configuration Binds to All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: snippets/common-configs.md, lines 37–44
Vulnerability Type: Insecure network exposure
Risk Level: Medium

Vulnerable Code

markdown

## Gateway Configuration
```json
{
  "gateway": {
    "host": "0.0.0.0",
    "port": 8080
  }
}

text

### Technical Analysis

The ready-to-use configuration binds the gateway to `0.0.0.0`, causing it to listen on every available network interface rather than only the local loopback interface. The example does not include authentication, TLS, firewall restrictions, network allowlisting, or a warning about the resulting exposure.

A user who copies this configuration may unintentionally make the gateway reachable from a local network, a container or cloud network, or the public Internet, depending on routing and firewall rules. Whether the service can ultimately be compromised depends on the gateway's separately configured access controls and exposed functionality.

### Attack Path

1. A user copies the documented gateway configuration.
2. The gateway starts listening on TCP port 8080 across all network interfaces.
3. Existing host, container, or cloud firewall rules permit an untrusted client to reach that port.
4. The client discovers and connects to the gateway.
5. The client probes or abuses any gateway functions that are not protected by separate authentication and authorization controls.

### Impact Assessment

This configuration may expand gateway access from local processes to remote network clients. An attacker could obtain access to whatever gateway endpoints and operations are reachable without separate controls. The exact privileges depend on the gateway's implementation and runtime authorization configuration; the audited files do not establish that unrestricted administrative access is available.

Remediation

View remediation

Remediation Suggestions

• Change the default bind address to 127.0.0.1 so the gateway is local-only:

json

{
  "gateway": {
    "host": "127.0.0.1",
    "port": 8080
  }
}

• Require an explicit, documented opt-in before binding to 0.0.0.0.
• Add a prominent warning explaining that 0.0.0.0 exposes the service through all reachable interfaces.
• Require strong authentication and authorization for every gateway operation.
• Protect remote traffic with TLS, preferably through a hardened reverse proxy.
• Restrict inbound traffic with host and cloud firewalls or network allowlists.
• Document container port-publishing and cloud security-group risks.
• Add automated checks that warn when a non-loopback binding is used without appropriate access controls.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a broad documentation assistant with multiple capabilities, including navigation logic, search, version tracking, and config snippets across all features. The supplied code chunk only implements a minimal shell helper that echoes a documentation URL based on an input path. It lacks the majority of the declared capabilities and even its stated fetching behavior is limited to printing the target URL rather than retrieving the document. This is a material mismatch in scope and primary functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description promises a broad documentation assistant with multiple capabilities across all Clawdbot features. The supplied code chunk only echoes a message about recently updated docs and does not actually perform search, navigation, fetching, version tracking, or config snippet generation. This is a material mismatch in primary purpose and implemented capabilities, even though the script loosely relates to documentation updates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.