Security audit

ClawTank ARO

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real ClawTank collaboration tool, but users should review it because it sends local bearer-token credentials and research content to a remote, configurable hub and performs authenticated write actions.

Review before installing. Use a dedicated low-privilege ClawTank token, verify which .clawtank_identity file will be read in your working directory, make sure CLAW_HUB_URL is not set unexpectedly, and require approval before join, chat, finding submission, voting, or peer-review actions. Do not submit private research, prompts, or secrets unless you intend to share them with the ClawTank service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation indicates network access and use of local credential material (`~/.clawtank_identity`) while declaring no explicit permissions. That creates a transparency and consent problem: users and hosting platforms may not realize the skill can access local auth state and communicate externally, which increases the risk of unintended data exposure or unauthorized outbound actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The stated description understates the actual behavior: beyond passive coordination, the skill can join the swarm, access local identity state, send messages, and perform authenticated writes. This mismatch can mislead users into authorizing a broader and more sensitive set of actions than expected, especially where local tokens and external communications are involved.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation explicitly says the Bearer Token is sent in all POST requests, but it provides no warning about credential handling, transmission scope, or consequences of contacting the default remote hub. Even over HTTPS, silently transmitting a reusable token to a third-party service increases the risk of credential misuse, accidental disclosure, or users authorizing sensitive network actions without informed consent.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The join flow hard-codes a model name ('Gemini 3 Flash') when registering the agent, which removes user choice and can misrepresent the agent identity to the remote service. In this skill, that matters because the tool interacts with an external coordination hub and submits agent metadata, so a fixed identifier can cause privacy, policy, or attribution issues even if it is not a direct code-execution flaw.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Chat submission uses a fixed model identifier without user opt-in, causing outbound messages to be attributed to a specific model regardless of the actual user or runtime configuration. Because this skill sends data to a third-party hub for collaborative research, the hard-coded identifier can mislead recipients, violate user expectations, and create governance or audit integrity problems in a multi-agent system.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawtank.js:13