ironclaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 AM UTC
• Version: 1.3.1

Overview

Ironclaw is a coherent safety-classification skill, but it directs users to send arbitrary messages, commands, skill files, and possible secrets to a third-party API without enough data-handling guardrails.

Install only if you are comfortable with checked content being sent to ironclaw.io. Do not submit real API keys, passwords, private keys, session cookies, proprietary code, private messages, or regulated data unless you have authorization and have redacted it first. Keep the API key out of prompts and logs, and treat heartbeat update checks as manual, user-approved network actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:128

Finding

Potential Disclosure of Sensitive Content to a Third-Party Classification Service

Content

View full analysis

", "criteria_text": "" } ``` The documented Data Guard use case explicitly includes potentially secret-bearing content: ```json { "content_text": "", "criteria_text": "Contains hardcoded secrets (API keys with real values not placeholders like 'your-key-here', private key PEM blocks, database URLs with real passwords, excludes type definitions and process.env references)" } ``` Other documented inputs include complete skill files, private messages, and shell commands. ### Technical Analysis The Skill instructs the agent to submit arbitrary content to `https://ironclaw.io/api/v1/label` for remote classification. This network access is related to the declared threat-classification functionality, and the audit found no evidence of covert transmission or executable exfiltration code. In particular, the phrase at `SKILL.md:204` concerning “data exfiltration via fetch/HTTP” is classifier criteria rather than malicious code. Nevertheless, the remote-classification design creates a confidentiality risk. The `content_text` field may contain API keys, private keys, passwords, database URLs, private messages, proprietary skill source code, or sensitive shell commands. The documentation does not require local redaction, data minimization, informed per-request approval, or exclusion of credentials before transmission. It also does not state the remote service's retention, logging, secondary-processing, or deletion behavior. The Data Guard workflow is especially proble ...[truncated 1879 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

**Install:** Download from ClawHub or copy from the URLs above.

**Updates:** We announce new versions on Moltbook (@ironclaw_io) with changelogs. Review changes before updating — never auto-overwrite skill files without reading what changed.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Example: Dangerous Command Detection

text

Contains destructive commands (rm -rf, dd if=/dev, mkfs, fork bomb like :(){ }, chmod 777, DROP DATABASE, curl|bash, wget+execute)

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

Example: Dangerous Command Detection

text

Contains destructive commands (rm -rf, dd if=/dev, mkfs, fork bomb like :(){ }, chmod 777, DROP DATABASE, curl|bash, wget+execute)

---

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The heartbeat goes beyond passive safety guidance and instructs the agent/operator to perform external update checks and authenticated API testing. In a skill context, recurring operational instructions that trigger network access and credential use expand the skill’s authority surface and can be abused for unintended outbound communication or secret exposure, especially if followed automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document instructs use of external network utilities (curl to a remote domain) for version checking, which is not clearly required for the stated threat-classification function. Even though it advises manual review before updating, embedding routine network actions in a heartbeat normalizes outbound access and creates an opportunity for tracking, remote content influence, or supply-chain style abuse if the endpoint or instructions change.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API test example uses a live-looking bearer token format and encourages authenticated requests without an explicit warning not to paste real credentials into logs, chats, or untrusted tools. In agent ecosystems, examples like this can lead users or agents to substitute actual secrets into prompts or command histories, causing credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to send arbitrary content to a remote API for classification, including messages, skill files, commands, and outbound data, but it does not clearly foreground that this content leaves the local environment and is transmitted to ironclaw.io. In a safety-focused skill, this omission is especially risky because users may submit secrets, private conversations, or proprietary code under the assumption they are performing a local safety check.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Example: Dangerous Command Detection

text

Contains destructive commands (rm -rf, dd if=/dev, mkfs, fork bomb like :(){ }, chmod 777, DROP DATABASE, curl|bash, wget+execute)

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

Example: Dangerous Command Detection

text

Contains destructive commands (rm -rf, dd if=/dev, mkfs, fork bomb like :(){ }, chmod 777, DROP DATABASE, curl|bash, wget+execute)

---

Static analysis

No suspicious patterns detected.