ClawHub
Back to skill

Security audit

snapback

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed remote diagnostics/self-healing integration, but it broadly streams agent run data to a third-party service and promotes optional autonomous repair, package installation, and wallet-based payment flows that deserve careful review.

Install only if you are comfortable sending agent traces and live run details to Snapback. Do not send secrets or regulated/proprietary traces unless you have reviewed Snapback's handling and retention terms. Treat snapback-selfheal as a separate executable dependency, require human approval for wallet/payment flows, and enable auto_apply only around tool calls where retry/refetch/config changes are acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The README asserts the skill is 'safe by construction' because it contains no scripts or binaries, but the documented behavior still connects to a remote MCP endpoint and can transmit agent data plus an authorization header over the network. That claim is misleading and may cause operators to underestimate the security implications of installing the skill, especially since MCP tools can influence agent behavior and expose sensitive run context to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
are free and need no token.
2. Register the MCP server:
   ```
   openclaw mcp add snapback --transport streamable-http --url https://api.snapback.sh/mcp \
     --header "Authorization: Bearer $SNAPBACK_TOKEN"
   openclaw mcp reload
   openclaw mcp probe snapback
Confidence
92% confidence
Finding
The skill is explicitly configured to use a third-party HTTPS MCP endpoint and optionally send a bearer token, which means agent prompts, run traces, or diagnostic context may be transmitted outside the local environment. In this skill's context that external transmission is core functionality, but it still creates real confidentiality and trust risks if operators are not clearly informed or if sensitive runs are sent to the service.

Skill Enumeration

Medium
Category
Agent Snooping
Content
openclaw mcp reload
   openclaw mcp probe snapback
   ```
   OR drop `SKILL.md` into `~/.openclaw/skills/snapback/SKILL.md` so it shows in `available_skills`.

### Installing the skill so your agent can see it
`clawhub install snapback-selfheal` installs **relative to the current directory** (into `./skills/`), so run
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
87% confidence
Finding
This markdown file is in scope for vague-trigger review. The description mixes specific trigger phrases with a very broad 'use this skill whenever' condition, including generic situations like 'wrong output' or 'watch my run', which overlap with many normal agent-assistance contexts and do not clearly bound when the skill should not activate.

External Transmission

Medium
Category
Data Exfiltration
Content
diagnose_batch / get_verdict / submit_feedback / agent_memory / preflight. Discovery, search_docs,
          detect_loop, budget_guard, convert_trace, request_pattern, and live sessions all work with NO token.
    mcp:
      endpoint: https://api.snapback.sh/mcp
      transport: streamable-http
      auth:
        type: bearer
Confidence
96% confidence
Finding
The skill is explicitly configured to send data to a third-party endpoint at api.snapback.sh over MCP. Because the documented purpose is diagnosis of agent failures and traces, invocation can transmit operational data, step history, prompts, outputs, and possibly sensitive metadata off-host; even with claimed redaction, this is still an external data exfiltration path by design.

External Transmission

Medium
Category
Data Exfiltration
Content
## Connect

- **Endpoint:** `https://api.snapback.sh/mcp` (Streamable HTTP / JSON-RPC 2.0)
- **Discovery:** `https://snapback.sh/.well-known/mcp.json` (tool list + schemas) · machine guide: `https://snapback.sh/llms.txt`
- **Auth:** `Authorization: Bearer $SNAPBACK_TOKEN` for the metered tools. Everything else is free, no token.
Confidence
96% confidence
Finding
This section reiterates use of the external MCP endpoint and normalizes remote submission as the standard connection path. In a security review context, this is a real data-transfer capability because an agent following the skill will send troubleshooting artifacts to a vendor-controlled service, expanding the trust boundary beyond the local environment.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- **Auth:** `Authorization: Bearer $SNAPBACK_TOKEN` for the metered tools. Everything else is free, no token.

**Calling a tool — IMPORTANT.** The only top-level JSON-RPC methods are `initialize`, `tools/list`, and
`tools/call`. Call every tool through `tools/call` — never as a top-level method (that returns `-32601 method
not found`):
```json
{"jsonrpc":"2.0","id":1,"method":"tools/call",
Confidence
80% confidence
Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Production (recommended):** pay-per-call via **x402** at `/mcp/x402` — no account, no limits. POST a trace,
  get an HTTP 402, pay ~$0.0032 USDC from your wallet, get the verdict. **Works on both Solana and EVM chains**
  (Base and other EVM networks); pick the chain your agent already runs on.
- **Validating first?** Self-register for a starter allowance: `POST https://api.snapback.sh/v1/agents/register`
  with `{"name":"my-agent","framework":"openclaw","accepted_terms":true}` (accepted_terms required — agrees to
  https://snapback.sh/legal/terms). Returns a token; store it as `SNAPBACK_TOKEN`.
Confidence
97% confidence
Finding
This section directs users to POST traces for paid diagnosis and to self-register with accepted terms, creating both external data transmission and payment-related interaction with a remote service. Compared with the generic endpoint references, this is more sensitive because it combines trace submission, identity/token issuance, and wallet/payment workflow, increasing privacy, financial, and compliance exposure if invoked automatically.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The Tools table at L088-L109 presents the available MCP tools, but later documentation advertises `diagnose_infra_error` (L110-L129) and additional capabilities such as `what_others_did` and `report_outcome` (L156-L158) that are not included there. This creates an intent/documentation inconsistency about what the skill actually provides, which can mislead users about available operations and trust boundaries.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill claims in its Security & data handling section that it 'installs nothing,' yet earlier instructs users to install both a Python package and a ClawHub package. This contradiction can mislead operators into underestimating local code execution and supply-chain risk, causing them to approve installation under false assumptions about the skill's behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
## Paying

- **Token (subscription):** your `vdk_` token meters `diagnose_trace` against your plan (Free 2000/mo).
- **Pay-per-call (x402):** no subscription — POST your `{"trace": {...}}` to `https://api.snapback.sh/mcp/x402`
  with no token. You get **HTTP 402** with the USDC contract, EIP-712 domain, payTo, amount (~$0.0032), and
  facilitator. Sign an EIP-3009 authorization and retry with the signed payment in the **`PAYMENT-SIGNATURE`**
  header (`X-PAYMENT` also accepted). An empty/unreadable trace is **never charged**. Supported on **Solana and
Confidence
97% confidence
Finding
The x402 payment flow requires sending traces to a remote endpoint and attaching signed payment material in headers, which materially expands risk beyond ordinary telemetry submission. If used by an autonomous agent, this can expose sensitive operational data while also enabling unintended financial actions or wallet interactions, making the context significantly more dangerous than routine remote diagnostics.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill advertises automatic self-healing on "ANY error," which creates an overly broad activation scope for autonomous recovery behavior. Even though the description includes guardrails, broad triggers increase the chance that the skill engages in inappropriate contexts, retries the wrong class of failures, or masks root causes instead of escalating, especially when integrated into agents that handle heterogeneous tools and side effects.

External Transmission

Medium
Category
Data Exfiltration
Content
"pip": "snapback-selfheal",
    "env": {
      "SNAPBACK_TOKEN": "optional — a vdk_ token from https://snapback.sh, only needed to meter diagnose_trace / report outcomes; the diagnosis tools are free and need no token",
      "SNAPBACK_MCP": "https://api.snapback.sh/mcp (default)",
      "SNAPBACK_CONF_MIN": "0.85 (the gate's confidence floor)"
    }
  },
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"pip": "snapback-selfheal",
    "env": {
      "SNAPBACK_TOKEN": "optional — a vdk_ token from https://snapback.sh, only needed to meter diagnose_trace / report outcomes; the diagnosis tools are free and need no token",
      "SNAPBACK_MCP": "https://api.snapback.sh/mcp (default)",
      "SNAPBACK_CONF_MIN": "0.85 (the gate's confidence floor)"
    }
  },
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.