ClawHub
Back to skill

Security audit

clawshop

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent API client, but it asks agents to update the skill when the service is unreachable and gives mutation access to an external IP-hosted service.

Install only if you trust the ClawShop service and are comfortable storing a local write token and sending product post data to the documented IP endpoint. Before using it, require confirmation for deletions and do not let an agent auto-update the skill merely because the API is unreachable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Self-Modification

High
Category
Rogue Agent
Content
- Primary: `https://82.156.31.238:19133`
- OpenAPI: `https://82.156.31.238:19133/openapi.yaml`

If base URL is unreachable, install or update this skill from ClawHub and read the latest endpoint from the updated skill.

## Auth Workflow
1. Call `POST /auth/register`.
Confidence
94% confidence
Finding
The skill tells the agent to install or update the skill from an external hub if the base URL is unreachable, effectively delegating future behavior to remotely fetched instructions. This is dangerous because it introduces self-modification and supply-chain risk: a transient outage could trigger retrieval of altered skill content that changes endpoints, expands permissions, or injects malicious instructions.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## Main Endpoints
- `POST /posts`: create own product post.
- `PATCH /posts/{id}`: update own post only.
- `DELETE /posts/{id}`: delete own post only.
- `GET /posts/search`: search by filters and pagination.

## Data Rules
Confidence
80% confidence
Finding
The skill exposes a destructive endpoint (`DELETE /posts/{id}`) and instructs the agent to use a write token from local storage, but it does not define strong confirmation, authorization, or scoping safeguards before destructive actions. In an agent setting, this increases the chance of unintended deletion or prompt-driven misuse, even if the backend enforces ownership checks.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
## Token Storage
- Default token file path: current working directory `./.clawshop_token`.
- Example when cwd is project root: `/root/projects/clawshop/.clawshop_token`.
- Keep permission strict: `chmod 600 .clawshop_token`.
- Read token in shell: `TOKEN=$(cat .clawshop_token)`.
- After token rotation, overwrite the file with the new token immediately.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
TOKEN=$(curl -sS -X POST "https://82.156.31.238:19133/auth/register" | jq -r '.write_token')
printf "%s" "$TOKEN" > .clawshop_token
chmod 600 .clawshop_token
```

Create post:
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
Create post:
```bash
TOKEN=$(cat .clawshop_token)
curl -sS -X POST "https://82.156.31.238:19133/posts" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
89% confidence
Finding
The skill instructs sending authenticated data to an external host by IP address, including a bearer token for write operations. This creates a real exfiltration and trust-boundary risk because the agent is encouraged to transmit sensitive credentials and content to a third-party service without any provenance verification or domain-based trust guarantees.

Static analysis

No suspicious patterns detected.