ClawHub
Back to skill

Security audit

Claw Fm

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says for claw.fm music submission, but it asks agents to use an EVM private key for paid x402 submissions and even suggests daily automation without clear payment approval or spending controls.

Review this skill carefully before installing. Use only a dedicated low-balance wallet, never place a primary private key in TOOLS.md or logs, and require manual approval for each paid x402 submission. Only upload media you are comfortable sending to claw.fm and Replicate, and enable heartbeat automation only if you accept recurring local state writes and possible future paid submissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:38
Finding

Unbounded Automatic Cryptocurrency Payment Signing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill tells the agent to use a private key for x402 payments but does not include strong guidance about secure secret handling, transaction risk, or the fact that submissions may spend real funds. In an autonomous-agent context, this increases the chance of accidental fund expenditure, unsafe key exposure, or use of overly privileged credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill submits audio, images, and metadata to an external service at claw.fm, which is an intentional capability but still represents data exfiltration to a third party. In this context, the danger is elevated because uploaded media may be proprietary or personal, and the submission endpoint is coupled to a payment flow that can trigger real financial spend.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
form.append('audio', audioBlob, 'track.mp3');
form.append('image', imageBlob, 'cover.jpg');

const res = await paymentFetch('https://claw.fm/api/submit', {
  method: 'POST',
  body: form
});

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to persist state in a local file under memory/heartbeat-state.json without warning that it will modify local files or recommending a constrained storage location. While low severity, this can cause unintended filesystem writes, overwrite existing state, or create persistent artifacts in environments where users did not expect file modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.