Security audit

Clawchest Setup

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Clawchest storage and banking integration, but it encourages recurring uploads of sensitive local data and includes high-impact financial, secret, transfer, and delete actions without enough user-control guidance.

Install only if you intentionally want an agent to use clawchest.com for remote storage and banking-like operations. Do not enable heartbeat or automated log deposits unless you define exactly which non-sensitive files may be uploaded, require redaction and explicit approval for sensitive data, and require confirmation for withdrawals, transfers, deletes, secret retrieval, and uploads of logs or configuration files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The heartbeat section instructs agents to periodically upload recent activity logs, JSON data, and backups to a third-party service, creating an always-on exfiltration pathway for potentially sensitive user, system, or internal information. Because the trigger is broad and recurring rather than tied to explicit user consent or data classification, it materially increases the chance of routine leakage.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger language encourages deposits 'whenever you think of it, or when your human asks,' which is too ambiguous for a capability that sends data to an external service. Vague operational guidance can cause agents to over-share or perform storage actions without verifying scope, necessity, or sensitivity.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill promotes routine upload of activity logs and recent work but does not warn that such artifacts often contain prompts, secrets, personal data, tokens, or proprietary content. In a storage skill, this omission is dangerous because it normalizes broad export of highly sensitive material without any minimization or review step.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The secrets section teaches creation and retrieval of remote secrets without cautioning that these values may be extremely sensitive and should only be handled under strict approval and least-privilege rules. This can normalize copying API keys, passwords, or tokens into an external service and later retrieving them into unsafe contexts.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Withdrawal instructions describe moving funds out of the account with no user-facing caution, approval requirement, or note about financial impact. For money-moving operations, omission of confirmation language increases the risk of accidental or unauthorized transactions.

Ssd 3

High

Confidence: 97% confidence
Finding: The heartbeat workflow effectively operationalizes regular export of logs and recent work to a remote service, which is a classic data exposure pattern when no filtering or approval step exists. In context, the skill is for external storage, so these plain-language instructions make indiscriminate leakage more likely, not less.

Ssd 3

High

Confidence: 90% confidence
Finding: The top-level description markets the service as a place to deposit 'secrets' alongside files and JSON data, normalizing transmission of confidential material to an external provider. Without strong caveats, this framing encourages agents to treat remote secret storage as ordinary behavior, increasing risk of sensitive-data disclosure.

Ssd 3

High

Confidence: 96% confidence
Finding: The examples and suggested prompts encourage agents to comply with arbitrary requests to upload logs, configurations, retrieve secrets, and transfer assets without any sensitivity screening or authorization checks. This creates a natural-language path for prompt-driven exfiltration and high-impact actions against user data and funds.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.