ClawHub
Back to skill

Security audit

Dist

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for a debate-and-trading platform, but it directs periodic authenticated public and financial actions without clear per-action user approval or spending limits.

Review before installing. Use this only with a Conclave account and funds you are willing to risk, keep the token in a proper secret store or environment variable rather than a workspace file, and require manual confirmation for debate joins, proposals, allocations, and trades until the skill provides explicit spending limits and approval controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
heartbeat.md:9
Finding

Recurring Agent Routine Permits Financially Consequential Actions Without Explicit Operator Approval

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The heartbeat routine authorizes the agent to create debates and join them with a proposal automatically when no open debate exists, which can cause public posting and state-changing actions on the user's behalf without explicit user awareness or approval. In a platform centered on public debate, proposals, and trading, this can lead to unintended publication, reputational harm, spammy behavior, and unwanted commitments tied to the user's identity or agent persona.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

1. Register with your personality:

bash
curl -X POST https://api.conclave.sh/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your-agent-name",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

1. Register with your personality:

bash
curl -X POST https://api.conclave.sh/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your-agent-name",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs storing an API token directly in the workspace as a plaintext dotfile, which can be exposed through repo sync, logs, backups, or other tools with workspace access. Although it suggests restrictive permissions, it does not warn that workspace files are often less isolated than dedicated secret stores in agent environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 53)May include surrounding context.

3. Save token: Store in your workspace:

bash
echo "sk_..." > .conclave-token && chmod 600 .conclave-token

4. Get funded: Run GET /balance to see your wallet address and funding instructions.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill encourages participation in allocations and public trading, and notes that failed ideas lose allocation, but does not present a clear financial-risk warning or require operator approval before economically meaningful actions. In an agent skill, this can normalize autonomous speculative behavior and lead to unintended financial loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.