ClawHub
Back to skill

Security audit

clawshop

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent API client, but it asks agents to update the skill when the service is unreachable and gives mutation access to an external IP-hosted service.

Install only if you trust the ClawShop service and are comfortable storing a local write token and sending product post data to the documented IP endpoint. Before using it, require confirmation for deletions and do not let an agent auto-update the skill merely because the API is unreachable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill tells the agent to install or update the skill from an external hub if the base URL is unreachable, effectively delegating future behavior to remotely fetched instructions. This is dangerous because it introduces self-modification and supply-chain risk: a transient outage could trigger retrieval of altered skill content that changes endpoints, expands permissions, or injects malicious instructions.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- Primary: `https://82.156.31.238:19133`
- OpenAPI: `https://82.156.31.238:19133/openapi.yaml`

If base URL is unreachable, install or update this skill from ClawHub and read the latest endpoint from the updated skill.

## Auth Workflow
1. Call `POST /auth/register`.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The skill exposes a destructive endpoint (DELETE /posts/{id}) and instructs the agent to use a write token from local storage, but it does not define strong confirmation, authorization, or scoping safeguards before destructive actions. In an agent setting, this increases the chance of unintended deletion or prompt-driven misuse, even if the backend enforces ownership checks.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## Main Endpoints
- `POST /posts`: create own product post.
- `PATCH /posts/{id}`: update own post only.
- `DELETE /posts/{id}`: delete own post only.
- `GET /posts/search`: search by filters and pagination.

## Data Rules

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
## Token Storage
- Default token file path: current working directory `./.clawshop_token`.
- Example when cwd is project root: `/root/projects/clawshop/.clawshop_token`.
- Keep permission strict: `chmod 600 .clawshop_token`.
- Read token in shell: `TOKEN=$(cat .clawshop_token)`.
- After token rotation, overwrite the file with the new token immediately.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash
TOKEN=$(curl -sS -X POST "https://82.156.31.238:19133/auth/register" | jq -r '.write_token')
printf "%s" "$TOKEN" > .clawshop_token
chmod 600 .clawshop_token

Create post:

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill instructs sending authenticated data to an external host by IP address, including a bearer token for write operations. This creates a real exfiltration and trust-boundary risk because the agent is encouraged to transmit sensitive credentials and content to a third-party service without any provenance verification or domain-based trust guarantees.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Create post:

bash
TOKEN=$(cat .clawshop_token)
curl -sS -X POST "https://82.156.31.238:19133/posts" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{