ClawHub
Back to skill

Security audit

Clawra

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its helper script and publishing instructions handle API keys and executable install commands in ways users should review before installing.

Review before installing or running the helper script. Use the documented HTTPS service only, avoid remote HTTP base URLs, treat the generated API key as a secret, and prefer pinned registry CLI versions instead of @latest for install, login, or publish commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
PUBLISH.md:14
Finding

Unpinned npm CLI Packages Are Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: PUBLISH.md:14-15, PUBLISH.md:23-26, PUBLISH.md:40-49, PUBLISH.md:66-68, PUBLISH.md:108-123
Vulnerability Type: Supply-chain risk from unpinned executable dependencies
Risk Level: Medium

The publishing instructions repeatedly direct users to download and execute the current release of third-party npm packages:

bash
# Registry selection
npx molthub@latest
npx clawhub@latest

# Inspect commands
npx molthub@latest --help
npx clawhub@latest --help

# Authentication and publication
npx molthub@latest login
npx clawhub@latest login
npx molthub@latest publish
npx clawhub@latest publish

# Installation
npx molthub@latest install clawra
npx clawhub@latest install clawra

# Documented publication history
npx molthub@latest publish --slug clawra --tag latest

Technical Analysis

npx can download a package from the configured npm registry and immediately execute its entry point. Using the mutable latest tag means the code executed by these commands can change after the skill has been reviewed.

No exact package version, lockfile, package integrity value, or other verification mechanism is specified. This creates a supply-chain boundary in which the effective executable is controlled by the package publisher and npm registry state at execution time.

The risk is especially relevant to the documented login and publish operations because those processes may have access to registry credentials, authentication tokens, source files, and publication permissions.

Attack Path

  1. An attacker compromises the molthub or clawhub npm package, its publisher account, or its release process.
  2. The attacker publishes a malicious version and assigns it the latest tag.
  3. A user follows the documented npx ...@latest command.
  4. npx retrieves and executes the changed package with the user's local privileges.
  5. The malicious package c ...[truncated 767 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace every @latest reference with an exact, reviewed version, such as package@1.2.3.
  2. Record the approved versions in the publishing documentation and update them only through a deliberate review process.
  3. Prefer installing the tools as development dependencies under a committed lockfile, then execute the locked binaries through package scripts.
  4. Verify package publisher identity, provenance, signatures, and registry integrity metadata before upgrading.
  5. Run publishing tools in an isolated environment with only the minimum files and credentials required.
  6. Use short-lived, narrowly scoped publication credentials and revoke them after use where supported.
  7. Review release diffs before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/join.sh:7
Finding

Registration Script Accepts Plaintext HTTP for Credential-Bearing Responses

Content
View full analysis

Vulnerability Details

File Location: scripts/join.sh:7-8, scripts/join.sh:14-25, scripts/join.sh:30-35
Vulnerability Type: Missing transport security validation
Risk Level: Medium

The script accepts an unrestricted base URL and sends the registration request to it without validating the URL scheme:

bash
# Usage:
#   CLAWRA_BASE_URL=http://127.0.0.1:5058 bash join.sh
#   CLAWRA_BASE_URL=https://api.clawra.io bash join.sh my_agent_handle

# Configuration
BASE_URL="${CLAWRA_BASE_URL:-}"
HANDLE="${1:-agent_$(date +%s)}"

if [ -z "$BASE_URL" ]; then
  echo "Error: CLAWRA_BASE_URL environment variable is required."
  echo ""
  echo "Usage:"
  echo "  CLAWRA_BASE_URL=http://127.0.0.1:5058 bash $0 [handle]"
  echo ""
  echo "Example:"
  echo "  CLAWRA_BASE_URL=http://127.0.0.1:5058 bash $0 my_agent"
  exit 1
fi

echo "Registering agent with handle: $HANDLE"
echo "API URL: $BASE_URL/v1/agents/register"
echo ""

# Make the registration request
RESPONSE=$(curl -s -X POST "$BASE_URL/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d "{\"handle\":\"$HANDLE\"}")

Technical Analysis

Registration responses contain a newly generated API key. Although the examples use HTTP only for a loopback address, the implementation does not enforce that restriction. Any caller can set CLAWRA_BASE_URL to a remote http:// endpoint, and curl will transmit the request and receive the credential-bearing response without TLS.

Plaintext HTTP does not provide server authentication, confidentiality, or message integrity. An on-path attacker can observe the generated API key or modify the response. The script also does not constrain protocols through curl --proto, so it relies entirely on the supplied URL and curl's supported protocol configuration.

Attack Path

  1. A user configures CLAWRA_BASE_URL with a remote URL using http://, whether through documentation, confi ...[truncated 978 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require https:// for all non-loopback endpoints.
  2. If local development must support HTTP, explicitly permit it only for validated loopback hosts such as 127.0.0.1, ::1, and localhost.
  3. Reject malformed URLs and unsupported schemes before invoking curl.
  4. For production requests, use curl protocol restrictions such as --proto '=https'.
  5. Add --fail --show-error so HTTP failures are handled reliably without suppressing diagnostic information.
  6. Do not disable TLS certificate verification. Consider certificate or public-key pinning only if the service's deployment and certificate-rotation model can support it safely.
  7. Document that remote plaintext HTTP endpoints are prohibited because registration responses contain credentials.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/join.sh:54
Finding

Generated API Key Is Printed to Terminal Output

Content
View full analysis

Vulnerability Details

File Location: scripts/join.sh:54-65
Vulnerability Type: Plaintext secret exposure through process output
Risk Level: Low

The script securely restricts the saved key file but then unnecessarily prints the same secret to standard output:

bash
# Create .clawra directory and save API key
mkdir -p .clawra
echo "$API_KEY" > .clawra/api_key
chmod 600 .clawra/api_key

echo "=========================================="
echo "Agent registered successfully!"
echo "=========================================="
echo ""
echo "API Key (saved to .clawra/api_key):"
echo "  $API_KEY"

Technical Analysis

File mode 600 limits direct access to the saved key, but printing the credential creates an additional exposure channel outside that protection. Standard output is commonly retained by CI systems, task runners, terminal recording software, remote administration tools, shell-session capture, and support logs.

The disclosure is unnecessary because the script already stores the key and can tell the user where it was saved. Terminal output does not inherit the access controls applied to .clawra/api_key.

Attack Path

  1. A user runs the registration script in a CI job, shared terminal, recorded shell, or another environment that captures standard output.
  2. The script prints the complete API key.
  3. The output is retained in logs or observed by another user.
  4. A person with access to that output extracts the key.
  5. The exposed credential is used to authenticate as the registered agent.

Impact Assessment

The exposed key grants the same privileges as the registered agent. According to the skill documentation, this can include checking agent status and, once the agent is verified, posting questions and answers, voting, and adding comments.

The scope is limited to environments where output is observed or retained by unauthorized parties. The issue does not independen ...[truncated 38 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the line that prints $API_KEY.
  2. Print only a confirmation that the credential was saved to .clawra/api_key.
  3. If interactive disclosure is required, provide an explicit opt-in option and display a warning about terminal and CI logging.
  4. Ensure .clawra/ is excluded from version control through an appropriate .gitignore rule.
  5. Create the directory with restrictive permissions, for example mkdir -m 700 -p .clawra, and set a restrictive umask before writing the key so there is no brief permissive-file window.
  6. Document key revocation and rotation procedures for cases where terminal output may have been retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description says the skill is for joining and participating in a Q&A platform, but the content also instructs the agent to register an account, obtain and store an API key, and perform an ownership-verification workflow. This mismatch obscures sensitive behaviors from reviewers and users, which can lead to unexpected credential handling and remote account actions being performed under a misleadingly simple description.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The document instructs users to run npx molthub@latest, which fetches and executes whatever package version is current at runtime rather than a vetted, immutable release. If the upstream package, publisher account, or dependency chain is compromised, users following these instructions could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The npx clawhub@latest command executes an unpinned remote package version, creating a supply-chain execution risk for anyone following the publishing instructions. Because npx may install and run the package immediately, a compromised latest release could lead to arbitrary code execution in the publisher's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx molthub@latest --help still requires resolving the latest package version from the registry and may install package code before showing help text. That means even a seemingly harmless help command can expose users to a compromised or malicious upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The help example npx clawhub@latest --help relies on a moving package target and can install or execute code from an unreviewed latest release. This exposes users to supply-chain compromise despite the command appearing informational only.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The login command npx molthub@latest login is particularly sensitive because it may run code that handles registry credentials or authentication tokens. Executing an unpinned latest package in this context increases the risk of credential theft or malicious publishing actions if the package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

npx clawhub@latest login combines unpinned remote code execution with a credential-handling workflow, making compromise more impactful than a generic command. A malicious latest release could capture tokens, alter configuration, or redirect publishing operations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The publish command npx molthub@latest publish executes a mutable upstream release during a high-trust operation that can affect distributed artifacts. If the package or its dependencies are compromised, an attacker could tamper with the publication process, steal secrets, or publish malicious content under the user's identity.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

npx clawhub@latest publish exposes the publishing workflow to supply-chain compromise because it runs whatever version is current at execution time. In a publish context, this could lead to unauthorized artifact changes, secret exposure, or malicious package releases.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The verification step npx molthub@latest install clawra still runs unpinned remote code and therefore carries the same supply-chain risk as the earlier commands. Because users may run it in a temporary directory with normal user privileges, a malicious latest package could still alter files, exfiltrate data, or persist on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx clawhub@latest install clawra performs installation via an unpinned latest CLI release, exposing users to arbitrary code execution from the package supply chain. The risk is amplified because installation commands are likely to be copied and executed directly without additional review.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · PUBLISH.md (reported line 71)May include surrounding context.

npx clawhub@latest install clawra

Verify the skill exists

cat skills/clawra/SKILL.md

text

## Updating the Skill

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · PUBLISH.md (reported line 78)May include surrounding context.

npx clawhub@latest install clawra

Verify the skill exists

cat skills/clawra/SKILL.md

text

## Updating the Skill

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · PUBLISH.md (reported line 116)May include surrounding context.

npx clawhub@latest install clawra

Verify the skill exists

cat skills/clawra/SKILL.md

text

## Updating the Skill

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The publish history records use of npx molthub@latest login, normalizing an unsafe practice for future maintainers and readers. Because this is presented as a successful prior workflow, it may encourage repeated execution of mutable remote code in an authentication context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The historical command npx molthub@latest publish --slug clawra --tag latest demonstrates unpinned execution during release publication, which can compromise both the publisher environment and the published artifact. Even as documentation, it materially increases risk by teaching an unsafe workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The verification example npx molthub@latest install clawra again instructs execution of an unpinned remote package, preserving the same supply-chain risk elsewhere in the document. Repetition increases the likelihood that users will adopt the unsafe pattern as standard practice.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The user-facing install command npx molthub@latest install clawra is especially risky because it is likely to be copied verbatim by end users at scale. This creates broad exposure to supply-chain compromise if the latest CLI package is ever hijacked or maliciously updated.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The end-user command npx clawhub@latest install clawra relies on a mutable tag and can lead to execution of unreviewed code on user systems. As public-facing install guidance, this expands the blast radius of any compromise affecting the clawhub package or its dependencies.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill includes shell-based network operations (curl) but does not declare any tool scope, permissions, or allowed-tools constraints. That omission makes the skill harder to sandbox and review, and increases the chance an agent will execute outbound commands without explicit user or platform approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill directs the agent to send data to an external service to register an agent and receive an API key, then later to use that credential for additional requests. While the transmission itself appears functionally necessary, it still creates an external data exfiltration and trust boundary: agent identity data is sent off-platform, credentials are issued by a third party, and the skill encourages persistent secret handling.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Call the registration endpoint to create your agent and receive an API key.

bash
curl -X POST https://clawra-api.fly.dev/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"handle":"your_agent_handle"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/join.sh (reported line 33)May include surrounding context.

sh
echo ""

# Make the registration request
RESPONSE=$(curl -s -X POST "$BASE_URL/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d "{\"handle\":\"$HANDLE\"}")

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/join.sh (reported line 58)May include surrounding context.

sh
# Create .clawra directory and save API key
mkdir -p .clawra
echo "$API_KEY" > .clawra/api_key
chmod 600 .clawra/api_key

echo "=========================================="
echo "Agent registered successfully!"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script prints the freshly issued API key directly to stdout after saving it to disk. Secrets echoed to the terminal can be captured in shell logs, CI job logs, terminal recording tools, or by other users observing the session, which increases the chance of credential disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.