clawim

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed Prismer Cloud integration, but it handles API keys and tokens in ways users should review carefully before installing.

Install only if you trust Prismer Cloud and are comfortable giving this CLI account-scoped credentials. Prefer an anonymous setup or a scoped, revocable API key; avoid pasting secrets into normal chat, rotate any key exposed this way, check permissions on ~/.prismer/config.toml, and consider installing a pinned SDK version instead of the unpinned global command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: Skill.md:17
• Finding: Unpinned Global Installation of a Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `Skill.md`, line 17 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @prismer/sdk ``` ### Technical Analysis The Skill instructs the user or Agent to install the latest available version of `@prismer/sdk` globally. No exact version, package integrity hash, provenance verification, or trusted-release validation is specified. Because npm resolves the package version at installation time, the code that executes can differ from the version originally reviewed. A compromised maintainer account, malicious package release, or registry compromise could cause arbitrary package code or npm lifecycle scripts to run during installation. The global installation scope also exceeds the minimum scope needed for a single Skill invocation. It makes the package available throughout the user environment and may modify globally managed npm directories or executable paths. The reviewed project does not contain the package source, so the external dependency's implementation could not be audited as part of this assessment. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the relevant package publication process. 2. The attacker publishes a malicious version of `@prismer/sdk`. 3. A user or Agent follows the Skill instructions and runs `npm install -g @prismer/sdk`. 4. npm resolves and installs the malicious version because no reviewed version is pinned. 5. Malicious installation scripts or package code execute with the privileges of the user running npm. 6. The installed global command remains available for later use and can access data available to that user. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, an attacker could access user files, environment variables, API cr ...[truncated 393 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact version that has been reviewed: ```bash npm install --global @prismer/sdk@X.Y.Z ``` 2. Publish the expected package version, integrity hash, repository, and npm provenance information. 3. Verify the resolved package and integrity metadata before installation. 4. Prefer a project-local installation over a global installation: ```bash npm install --save-exact @prismer/sdk@X.Y.Z ``` 5. Run the dependency with the minimum required operating-system permissions and never install it as root unless strictly necessary. 6. Disable npm lifecycle scripts when they are not required and compatible with the package: ```bash npm install --ignore-scripts --save-exact @prismer/sdk@X.Y.Z ``` 7. Establish a dependency update process that reviews and tests each new version before changing the pinned release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: Skill.md:25
• Finding: Credentials Passed Through Chat and Command-Line Arguments and Stored in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `Skill.md`, lines 25-31, 68-69, 180, and 343-354 **Vulnerability Type**: Unsafe credential collection, transmission, and storage **Risk Level**: Medium ### Vulnerable Code The Skill asks the user to share an API key with the Agent and places it directly in a command: ```markdown > I need a Prismer Cloud API key to use context/parse/IM services. Please visit https://prismer.cloud, sign up (GitHub/Google one-click), then go to **Dashboard → API Keys → Create** and share the key with me. It looks like `sk-prismer-...`. If the user provides a key, bind it: ```bash prismer init <the-api-key-from-user> ``` ``` A webhook secret is supplied as a command-line argument: ```bash --endpoint https://your-server.com/webhook \ --webhook-secret your-hmac-secret ``` A Telegram bot token is also supplied as a command-line argument: ```bash prismer im bindings create telegram --bot-token xxx --chat-id yyy ``` The documented configuration stores the API key and IM JWT as plaintext values: ```toml [default] api_key = "sk-prismer-xxx" # optional, for bound registration [auth] im_token = "eyJ..." # IM JWT im_user_id = "pxoi9cas5rz" # IM User ID im_username = "my-agent" # Username ``` ### Technical Analysis The API key is requested through the Agent conversation itself. This can place the credential in conversation history, telemetry, debugging traces, tool-call records, or other logs retained by the Agent platform. The API key, webhook secret, and Telegram bot token are then passed as command-line arguments. Depending on the operating system, shell, and execution environment, command arguments may be exposed through shell history, process listings, audit logs, terminal capture, Agent traces, or error reporting. The documented configuration also contains long-lived authentication material in plaintext. The Skill does not require restrictive file permissions, encryption through an ...[truncated 2751 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys, bot tokens, or other credentials into Agent conversations. 2. Use a masked interactive prompt, standard input, an environment variable, or an operating-system credential manager. For example, the CLI could prompt securely: ```bash prismer init ``` The command should then read the key without echoing it or including it in process arguments. 3. Replace command-line secret options with protected input mechanisms, such as: - Reading from standard input. - Reading from a permission-restricted file descriptor. - Referencing a secret-manager entry. - Using environment variables only when the execution environment prevents environment leakage. 4. Store long-lived credentials in the operating system's keychain or a dedicated secret manager rather than a plaintext TOML file. 5. If a configuration file must contain credentials: - Create it with `0600` permissions. - Validate ownership before reading it. - Refuse to use it if group or world access is enabled. - Avoid copying it into backups, support bundles, or source control. 6. Redact values matching API-key, JWT, webhook-secret, and bot-token formats from logs, exceptions, telemetry, and tool-call transcripts. 7. Use short-lived, narrowly scoped tokens where supported. Separate credentials by service and avoid reusing secrets. 8. Provide explicit credential revocation and rotation instructions for accidental exposure. 9. Ensure webhook receivers verify HMAC signatures using constant-time comparison, reject stale or replayed requests, and rotate compromised webhook secrets. 10. Document exactly what data is transmitted to Prismer Cloud and require explicit user confirmation before uploading local files or sensitive document content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the user to share a raw API key with the agent, which is a credential-handling anti-pattern. In an agent setting, this is dangerous because the key may be exposed in logs, chat history, telemetry, downstream tools, or prompt context, enabling unauthorized use of the user's account and services.

External Transmission

Medium

• Category: Data Exfiltration

Content

prismer files presign report.pdf --mime application/pdf

# 2. Upload to returned URL
curl -X PUT "$PRESIGNED_URL" -H "Content-Type: application/pdf" --data-binary @report.pdf

# 3. Confirm
prismer files confirm <upload-id>

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents storage of API keys and JWTs in a local config file without any warning about filesystem protections, token sensitivity, or rotation. This increases the chance that credentials are left readable by other local users, included in backups, committed to source control, or exfiltrated by other tools on the host.

Static analysis

No suspicious patterns detected.