T09 · Insecure Skill Coding Practices
Warning
- Location
example-integration.js:49- Finding
Plaintext Logging of User Messages and Session Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawsaver
Security checks for vulnerabilities and agentic risk
Overview
ClawSaver is a coherent local message-batching utility, with privacy considerations around delayed/merged messages and example logging but no evidence of hidden execution or exfiltration.
Before installing, confirm your application can tolerate short message delays and combined model prompts. Avoid using the provided example logging unchanged in production, especially for chats that may contain personal, regulated, credential, or business-sensitive content.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Yes, this is a clear mismatch. The declared purpose describes a runtime optimization feature for buffering and batching model messages to reduce API costs. The actual code does not implement batching, message handling, or model API interactions at all. Instead, it is a publication/deployment script for releasing a package to ClawHub via npm, including test execution, authentication, publishing, and post-publish verification. That is a materially different primary purpose and introduces undeclared external registry access and publishing capabilities.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md files: ["SessionDebouncer.js", "example-integration.js"]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide promotes batching user messages and reporting metrics without warning that multiple user inputs may be merged, retained briefly, and potentially logged or exposed to operators differently than the original per-message flow. This can cause privacy, consent, and data-handling issues, especially where users expect immediate one-message processing or where message content may be sensitive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The zero-config section encourages automatic handler wrapping and session logging with 'No code changes needed' but does not disclose that this silently modifies message flow and may log session-level data. Automatic interception without explicit notice increases the risk of unreviewed deployment of privacy-impacting behavior and weakens informed operator consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide explicitly merges multiple user messages and forwards them as one model input, but it does not warn integrators about the privacy and context-boundary risks of combining separate user submissions. In multi-turn or mixed-sensitivity sessions, batching can unintentionally co-transmit data a user expected to remain separate, increase prompt-injection surface across messages, and weaken consent or policy controls tied to per-message handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The summary promotes buffering and merging multiple user messages into one model request but does not warn that this changes how user content is processed and may have privacy implications. In multi-user, regulated, or consent-sensitive environments, silently aggregating messages can increase exposure of sensitive data, alter data minimization assumptions, and create compliance or user-expectation issues.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill whose purpose is intelligent message batching for cost reduction. This script instead logs into an external package registry, publishes the package, and verifies publication, which is release-engineering behavior rather than message batching functionality.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a markdown file, so SQP-2 applies to user-facing descriptions that omit warnings about behaviors affecting user data or system behavior. The file highlights automatic batching and latency impact, but it frames them as features/performance notes rather than a caution that user messages may be delayed and combined before downstream handling.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code merges multiple user messages into a single prompt and passes that combined text plus session metadata to
modelFn. Although the file documents the batching behavior for developers, it does not include any user-facing disclosure, confirmation, or warning that user input may be aggregated and forwarded together to a downstream model handler.- Content
Static analysis
No suspicious patterns detected.