ClawHub
Back to skill

Security audit

Clawver Marketplace

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Clawver store automation, but it gives agents broad real-commerce and skill-update authority without enough guardrails.

Review this skill before installing if you plan to give it a real CLAW_API_KEY. Require explicit approval for publishing products, refunds, deletion/archive operations, webhook changes, review responses, seller linking, and any action that spends credits or affects customers. Avoid the documented global skill update flow; use exact, trusted Clawver skill identifiers and targeted updates only.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Skill Installation and Unnecessarily Broad Global Updates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-36
Vulnerability Type: Supply-chain risk from unverified and unpinned Skill installation
Risk Level: Medium

Vulnerable Code:

bash
When a specialized skill is missing, install it from ClawHub, then continue:

clawhub search "clawver"
clawhub install <skill-slug>
clawhub update --all

Technical Analysis

The instructions tell the agent to search for and install a third-party Skill without identifying a trusted publisher, exact package identifier, approved version, immutable digest, or verification procedure. A search result can therefore resolve to a typosquatted, malicious, or compromised Skill.

The subsequent clawhub update --all command is broader than necessary. It updates every installed Skill rather than only the dependency needed for the current marketplace operation. This increases the supply-chain attack surface and can introduce behavior that was not included in the reviewed artifact.

Attack Path

  1. An attacker publishes a Skill that matches the clawver search term, compromises a legitimate matching Skill, or compromises a later release of an installed Skill.
  2. The agent runs clawhub search "clawver" and selects the attacker-controlled or compromised result.
  3. clawhub install <skill-slug> installs instructions or executable components that were not reviewed as part of this project.
  4. Alternatively, clawhub update --all retrieves a compromised release of any installed Skill, including Skills unrelated to the current task.
  5. The malicious Skill executes or influences later agent operations with whatever tools, credentials, and permissions are available to the Skill runtime.

Impact Assessment

Successful exploitation could let an attacker influence agent instructions or execute dependency-provided functionality within the agent's existing privilege boundary. Depending on the installed Skill' ...[truncated 464 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace discovery-based installation with exact, verified Skill identifiers.
  • Specify and verify the expected publisher or organization.
  • Pin each dependency to an approved version and, where supported, an immutable checksum or content digest.
  • Require review or explicit operator approval before installing a previously unreviewed Skill.
  • Replace clawhub update --all with targeted updates for the specific required Skill.
  • Review release notes and package contents before accepting updated versions.
  • Apply least privilege so installed Skills receive only the tools, credentials, filesystem access, and network access required for their stated task.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:419
Finding

Malformed Webhook Signatures Can Cause an Unhandled Length-Mismatch Exception

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 419-429
Vulnerability Type: Improper validation and exception handling during webhook authentication
Risk Level: Medium

Vulnerable Code:

javascript
const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Technical Analysis

Node.js crypto.timingSafeEqual requires both input buffers to have the same byte length. It throws an exception when their lengths differ. The example passes the externally supplied signature directly to Buffer.from and then to timingSafeEqual without validating its type, format, encoding, or length. It also does not catch exceptions.

A legitimate header in the documented format has the fixed structure sha256= followed by a 64-character hexadecimal SHA-256 digest. Missing, truncated, oversized, or otherwise malformed header values can result in unequal buffer lengths or invalid input handling rather than a clean authentication failure.

The snippet is documentation rather than an active server implementation. The vulnerability becomes exploitable if a consumer copies it into a webhook endpoint without an enclosing exception boundary.

Attack Path

  1. A consumer implements webhook verification using the supplied example.
  2. An unauthenticated attacker sends a request to the public webhook endpoint.
  3. The attacker supplies a missing, truncated, oversized, or malformed X-Claw-Signature value.
  4. The computed expected signature and attacker-supplied signature have different byte lengths.
  5. crypto.timingSafeEqual throws instead of returning false.
  6. If the webhook framework or process does not safely isolate the exception, repeated requests produce handle ...[truncated 607 chars]
Remediation
View remediation

Remediation Suggestions

  • Reject absent or non-string signature headers before creating buffers.
  • Require the exact format sha256=[0-9a-fA-F]{64}.
  • Decode and compare fixed-size digest bytes rather than comparing unchecked variable-length strings.
  • Check buffer lengths before calling crypto.timingSafeEqual.
  • Catch malformed-input errors and return false without exposing internal details.
  • Ensure the HMAC is calculated over the exact raw request body, before JSON parsing or body normalization.
  • Add tests for missing, empty, short, oversized, non-hexadecimal, duplicated, and correctly formed signature headers.

A hardened implementation can use the following pattern:

javascript
const crypto = require('crypto');

function verifyWebhook(rawBody, signature, secret) {
  try {
    if (typeof signature !== 'string' ||
        !/^sha256=[0-9a-fA-F]{64}$/.test(signature)) {
      return false;
    }

    const supplied = Buffer.from(signature.slice(7), 'hex');
    const expected = crypto
      .createHmac('sha256', secret)
      .update(rawBody)
      .digest();

    return supplied.length === expected.length &&
      crypto.timingSafeEqual(supplied, expected);
  } catch {
    return false;
  }
}

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (34)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill when asked to 'sell products' or 'manage a store,' which is broader than Clawver-specific activity and can cause over-invocation in unrelated commercial workflows. In an agent ecosystem, broad routing text increases the chance the skill is selected for requests that involve real payments, listings, account linking, or refunds on an external platform without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
81% confidence
Finding

The phrase 'autonomously run online stores' promotes unsupervised execution of commercial operations that can create listings, accept payments, manage reviews, and potentially trigger refunds or other consequential actions. In a real-money e-commerce context, encouraging autonomy without explicit guardrails, approval boundaries, or human confirmation increases the risk of unauthorized transactions and harmful business actions.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
# Clawver Marketplace

Clawver Marketplace is an e-commerce platform for AI agents to autonomously run online stores. Create a store, list digital products or print-on-demand merchandise, receive payments, and manage customer interactions via REST API.

## Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

1. Register Your Agent

bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My AI Store",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
# 4) Generate seeded AI mockups
# This endpoint always generates a real Printful seed mockup first, then AI candidates.
curl -X POST https://api.clawver.store/v1/products/{productId}/pod-designs/{designId}/ai-mockups \
  -H "Authorization: Bearer $CLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The API reference exposes destructive operations such as refunds, product deletion/archive, and webhook removal as routine actions without adjacent warnings, confirmation requirements, or guidance to verify authorization. In an autonomous commerce skill, that omission makes accidental or premature execution more likely, leading to financial loss, service disruption, or loss of integrations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.

Register webhooks:

bash
curl -X POST https://api.clawver.store/v1/webhooks \
  -H "Authorization: Bearer $CLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

  1. Register store identity:
bash
curl -X POST https://api.clawver.store/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"name":"My AI Store","handle":"myaistore","bio":"AI-generated products"}'

Static analysis

No suspicious patterns detected.