ClawHub
Back to skill

Security audit

Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but should be reviewed because it sends trajectory-analysis requests to ClawTrace and tells the agent to immediately change behavior and write persistent memory without explicit user approval.

Install only if you trust ClawTrace with your trajectory history and are comfortable with an agent using its recommendations to change behavior. Before using it, prefer requiring explicit approval for each API call, redacting sensitive trace content, and reviewing any proposed MEMORY.md entry before it is written.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to write Tracy-derived insights into MEMORY.md, which is a persistent local file unrelated to the minimum functionality required to query an external trajectory-analysis service. Persisting external analysis into local memory can create unintended long-term storage of sensitive or misleading data and expands the blast radius beyond the current session.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to send questions, trace identifiers, and implicitly trajectory-derived context to an external API without a clear disclosure about data sharing or the sensitivity of prior run contents. Because trajectory data may contain prompts, tool inputs, outputs, or user-provided secrets, this omission creates a meaningful privacy and compliance risk.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The instructions to log learnings into MEMORY.md do not warn that this alters persistent local user data. Even if the content seems operational, users should be informed before the agent writes analysis-derived summaries into durable storage.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to send questions plus trace_id/session_id context to a third-party API, but it does not clearly warn that operational history and potentially sensitive trajectory content will leave the local environment. Because trace/session identifiers can enable retrieval or correlation of prior runs, users may unknowingly disclose sensitive prompts, outputs, or metadata to an external service.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill directs the agent to immediately alter session behavior and write learnings into MEMORY.md without first obtaining explicit approval for modifying local state or files. This can create persistent side effects, contaminate future runs, and cause unexpected changes to agent behavior based on unverified external recommendations.

Ssd 3

Medium
Confidence
94% confidence
Finding
The prompt template asks Tracy to identify 'what was the input that caused' a failure, encouraging retrieval and restatement of potentially sensitive prior user inputs in plain language. This increases the chance that secrets, personal data, or confidential business content from historical runs are surfaced unnecessarily or transmitted externally.

Ssd 3

Medium
Confidence
93% confidence
Finding
Recording Tracy's findings in MEMORY.md can persist sensitive trajectory-derived details across sessions, including summaries of failures, inputs, or operational weaknesses. Persistent cross-session storage raises exposure risk compared with ephemeral session-only guidance.

External Transmission

Medium
Category
Data Exfiltration
Content
## How to Call the Endpoint

Send a POST request to `https://api.clawtrace.ai/v1/evolve/ask`.

Authentication uses your observe key, which is already set in your environment as `CLAWTRACE_OBSERVE_KEY`.
Confidence
95% confidence
Finding
This is a direct instruction to transmit data to an external domain, creating an outbound data flow from the agent environment to a third-party service. In this skill's context, the transmitted content is specifically about trajectories and operational history, which may contain sensitive prompts, tool outputs, or user data.

External Transmission

Medium
Category
Data Exfiltration
Content
with httpx.stream(
        "POST",
        "https://api.clawtrace.ai/v1/evolve/ask",
        headers={
            "Authorization": f"Bearer {observe_key}",
            "Content-Type": "application/json",
Confidence
96% confidence
Finding
The sample code operationalizes the outbound request, including authorization and JSON payload submission to a third-party endpoint. Because the function accepts arbitrary questions and optional trace/session identifiers, it increases the chance that sensitive runtime context will be exfiltrated during normal use.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def ask_tracy(question: str, trace_id: str = None, session_id: str = None) -> str:
    """Ask Tracy to analyze trajectories and return recommendations."""
    observe_key = os.environ.get("CLAWTRACE_OBSERVE_KEY", "")
    if not observe_key:
        return "ClawTrace observe key not configured."
Confidence
90% confidence
Finding
The skill reads a bearer credential from the environment and uses it to authenticate outbound requests to an external service. Even though it does not explicitly print the key, instructing an agent skill to harvest environment secrets for network use expands the blast radius of prompt-driven behavior and creates a reusable exfiltration primitive if the skill or endpoint is abused.

Self-Modification

High
Category
Rogue Agent
Content
---
name: ClawTrace Self-Evolve
description: Ask Tracy to analyze your recent trajectories and improve your agent behavior based on data-driven recommendations.
version: 1.0.0
metadata: {"openclaw":{"emoji":"🔬","os":["linux","darwin","win32"],"homepage":"https://clawtrace.ai","requires":{"env":["CLAWTRACE_OBSERVE_KEY"]}}}
Confidence
88% confidence
Finding
The skill is explicitly framed as 'Self-Evolve' and is designed to improve agent behavior based on external feedback, which is a form of self-modification. In combination with the later instructions to immediately apply recommendations, this creates a pathway for remote influence over future behavior without robust validation or user approval.

Self-Modification

High
Category
Rogue Agent
Content
metadata: {"openclaw":{"emoji":"🔬","os":["linux","darwin","win32"],"homepage":"https://clawtrace.ai","requires":{"env":["CLAWTRACE_OBSERVE_KEY"]}}}
---

# ClawTrace Self-Evolve Skill

You have access to ClawTrace, an observability platform that captures and analyzes all your trajectories. Use this skill to understand your own performance and improve over time.
Confidence
89% confidence
Finding
This section encourages the agent to use external trajectory analysis to understand and improve its own performance over time, reinforcing the self-modification pattern. In context, the danger is heightened because the same document later directs immediate behavioral changes and persistence to MEMORY.md, allowing external analysis to shape future agent conduct.

Static analysis

No suspicious patterns detected.