ClawHub
Back to skill

Security audit

Clawver Store Analytics

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently helps authorized Clawver store owners query store analytics, orders, and reviews, but users should treat the API key and returned business data as sensitive.

Install this only for users who are allowed to view the Clawver store's revenue, order, refund, and review data. Use a least-privilege CLAW_API_KEY, avoid running the shown curl commands on shared machines where process arguments may be visible, and do not ask the agent to fetch raw orders or reviews unless that detail is actually needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:26
Finding

API bearer token exposed through command-line arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26-28, 65-79, 88-89, 144-149, 169-170; references/api-examples.md:5-6, 13-14, 21-22
Vulnerability Type: Bearer credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

SKILL.md:26-28:

bash
curl https://api.clawver.store/v1/stores/me/analytics \
  -H "Authorization: Bearer $CLAW_API_KEY"

SKILL.md:65-79:

bash
# Last 7 days
curl "https://api.clawver.store/v1/stores/me/analytics?period=7d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

# Last 30 days (default)
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

# Last 90 days
curl "https://api.clawver.store/v1/stores/me/analytics?period=90d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

# All time
curl "https://api.clawver.store/v1/stores/me/analytics?period=all" \
  -H "Authorization: Bearer $CLAW_API_KEY"

references/api-examples.md:5-6:

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

Technical Analysis

The shell expands $CLAW_API_KEY before starting curl. Consequently, the resulting plaintext authorization header is supplied as part of the curl argument vector. On systems where process arguments are visible, another local account or process may inspect process listings or /proc entries while the request is running and recover the bearer token.

The examples consistently use HTTPS, so this issue does not imply that the credential is exposed over the network in plaintext. The weakness is local disclosure through the process interface. Exploitability therefore depends on operating-system process visibility, account isolation, and the attacker's ability to observe processes at the time a request is made.

Attack Path

  1. A user or automated agent runs one of the documented curl co ...[truncated 1173 chars]
Remediation
View remediation

Remediation Suggestions

  • Avoid passing expanded secrets directly in command-line arguments.
  • Provide the authorization header through a temporary or persistent curl configuration file protected with owner-only permissions, such as mode 0600, and delete temporary files immediately after use.
  • If the execution environment supports it, use a credential-aware API client that constructs authorization headers internally without exposing their values in process arguments.
  • Ensure API tokens use the minimum permissions required for read-only analytics operations.
  • Restrict process visibility and prevent untrusted users or workloads from sharing the same execution account.
  • Never enable shell tracing while handling the token, because tracing can expose the expanded credential in logs.
  • Redact authorization headers from application, proxy, debugging, and audit logs.
  • Rotate any token suspected of process-list exposure and monitor API access logs for unauthorized reuse.
  • Update every affected example in both SKILL.md and references/api-examples.md so users are not directed toward the insecure invocation pattern.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation text is broad enough to match common business prompts like sales data, performance reports, or store metrics, which increases the chance the skill is invoked in situations where the user did not intend to authorize access to sensitive store data. Over-broad triggering can cause unnecessary retrieval and exposure of confidential business analytics and review information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill shows repeated examples of retrieving revenue, orders, product performance, and reviews using a bearer token, but it never warns that this is sensitive business data or that access should be limited to authorized users and minimal scope. In an agent setting, that omission raises the risk of over-sharing confidential commercial data in response to loosely phrased requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 6)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 15)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-examples.md (reported line 24)May include surrounding context.

Good Example: Period-Based Store Analytics

bash
curl "https://api.clawver.store/v1/stores/me/analytics?period=30d" \
  -H "Authorization: Bearer $CLAW_API_KEY"

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description frames the skill as an analytics/reporting tool for revenue, products, conversion, and growth trends. However, the file expands into direct access to full order listings and all reviews, which are broader operational data retrieval capabilities rather than just analytics summaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.