Security audit

Clawnalyst

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent, but it can publish public trading calls and change sensitive Clawnalyst profile fields, including payout wallet settings, without tight safeguards.

Review this before installing if you plan to connect a real Clawnalyst account. Only use a scoped API key if available, confirm every signal/profile update yourself, avoid putting secrets or proprietary strategy in the reasoning field, and be especially careful with payoutWallet, subscription price, and active status changes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get_stats.sh:4
Finding: API Key Exposed Through Curl Process Arguments in Statistics Retrieval
Content: View full analysis
Vulnerability Details

File Location: scripts/get_stats.sh:4
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

Complete Code Snippet:

bash
curl -s "https://api.clawnalyst.com/v1/agents/me/profile" -H "X-API-Key: ${CLAWNALYST_API_KEY}"

Technical Analysis

The shell expands CLAWNALYST_API_KEY before starting curl. Consequently, the complete authentication header may appear in the process argument vector for the lifetime of the request. On systems where process metadata is accessible to other local users, monitoring agents, diagnostic utilities, or privileged processes, the key may be recovered from process inspection interfaces such as /proc or process-listing tools.

TLS protects the credential in transit but does not prevent this local process-level disclosure.

Attack Path

An attacker obtains local access or access to process-monitoring telemetry on the host running the Skill.

The attacker continuously monitors newly created process argument vectors.

A user invokes get_stats.sh.

The shell expands the environment variable into the curl header argument.

The attacker captures the API key from the process metadata.

The attacker reuses the key against the authenticated Clawnalyst API.

Impact Assessment

Successful exploitation exposes the Clawnalyst API credential. Based on the audited scripts and documentation, the compromised credential may allow access to the agent's private profile data and may also authorize signal publication or profile modification through other API operations. The precise scope depends on the permissions assigned to the API key. Exploitation requires local process visibility or access to monitoring data; it does not provide operating-system privilege escalation by itself.
Remediation: View remediation
Remediation Suggestions

Avoid placing authentication headers containing secrets directly in command-line arguments.

Supply the header through a curl configuration read from standard input or a temporary file with mode 0600, and remove any temporary file reliably after use.

Ensure the configuration mechanism does not itself expose the secret in process arguments.

Restrict process inspection and monitoring-log access according to least privilege.

Redact authorization headers from observability and diagnostic systems.

Rotate the API key if process arguments may previously have been collected.

One possible stdin-based pattern is:

bash
printf 'header = "X-API-Key: %s"\n' "$CLAWNALYST_API_KEY" | curl --config - "https://api.clawnalyst.com/v1/agents/me/profile"

Confirm the behavior of the deployed curl version and ensure standard input is not logged or retained.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/post_signal.sh:5
Finding: API Key Exposed Through Curl Process Arguments During Signal Publication
Content: View full analysis
Vulnerability Details

File Location: scripts/post_signal.sh:5-8
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

Complete Code Snippet:

bash
curl -s -X POST "https://api.clawnalyst.com/v1/signals" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${CLAWNALYST_API_KEY}" \ -d "${BODY}"

Technical Analysis

The shell interpolates CLAWNALYST_API_KEY into the authentication header before executing curl. The resulting API key may therefore be visible in the process argument vector while the HTTP request is active. Any local principal or monitoring facility capable of inspecting those arguments could capture the credential.

The request body is also passed through -d and therefore appears in the argument vector. Although the documented signal body is not inherently secret, reasoning or market-position information could be exposed locally before publication. The confirmed security issue is the API credential disclosure.

Attack Path

An attacker gains local process-inspection capability or access to process telemetry.

The attacker monitors for executions of curl or post_signal.sh.

A user publishes a signal through the script.

The shell places the expanded API key in curl's argument vector.

The attacker extracts and stores the key.

The attacker submits unauthorized signals or invokes other API methods authorized by that key.

Impact Assessment

A stolen key may allow an attacker to publish fraudulent trading signals under the victim agent's identity. This could damage the agent's permanent performance record, reputation, leaderboard position, subscription eligibility, and subscriber trust. If the same key authorizes profile operations, the attacker may also modify account settings. This issue does not directly grant host-level privileges and requires access to local process information or collected telemetry.
Remediation: View remediation
Remediation Suggestions

Pass the API header through a protected curl configuration supplied via standard input or a mode-0600 temporary file rather than through argv.

Pass the JSON request body through standard input using --data-binary @- so potentially sensitive reasoning is not stored in process arguments.

Validate the JSON body and enforce the documented fields before transmission.

Restrict API-key permissions to signal publication if the service supports scoped credentials.

Redact credentials and request payloads from monitoring systems.

Rotate keys that may have appeared in historical process telemetry.

A safer structure is:

bash
{ printf 'header = "Content-Type: application/json"\n' printf 'header = "X-API-Key: %s"\n' "$CLAWNALYST_API_KEY" } >"$CONFIG_FILE" chmod 600 "$CONFIG_FILE" printf '%s' "$BODY" | curl --config "$CONFIG_FILE" -s -X POST \ --data-binary @- "https://api.clawnalyst.com/v1/signals"

Create CONFIG_FILE securely with mktemp, install an exit trap to delete it, and ensure its parent directory is not shared.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/update_profile.sh:5
Finding: API Key Exposed Through Curl Process Arguments During Profile Updates
Content: View full analysis
Vulnerability Details

File Location: scripts/update_profile.sh:5-8
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

Complete Code Snippet:

bash
curl -s -X PUT "https://api.clawnalyst.com/v1/agents/me/profile" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${CLAWNALYST_API_KEY}" \ -d "${BODY}"

Technical Analysis

The API key is expanded into a curl command-line header and may be exposed through process metadata. The profile update body is likewise placed in argv through -d. This is particularly significant because the documented update fields include payoutWallet, subscription pricing, and account activation status.

An attacker able to observe process arguments can capture the credential without intercepting the TLS-protected network connection.

Attack Path

An attacker obtains access to local process arguments, privileged diagnostics, or process-monitoring records.

The attacker waits for a profile update operation.

A user invokes update_profile.sh.

The shell expands the API key into curl's command-line arguments.

The attacker captures and reuses the credential.

Where permitted by the key, the attacker modifies profile fields such as the payout wallet, pricing, biography, tags, avatar, or active status.

Impact Assessment

Credential compromise may permit unauthorized account and profile changes. The most consequential documented possibility is modification of payoutWallet, which could redirect future platform payouts if the server does not require additional verification. An attacker may also alter subscription pricing, deactivate the agent, or deface public profile data. The exact impact depends on server-side authorization and verification controls that are outside the audited project. The issue does not itself grant operating-system privileges.
Remediation: View remediation
Remediation Suggestions

Remove the authentication header from the process argument vector by using a protected curl configuration through standard input or a securely created mode-0600 file.

Send the profile JSON through standard input with --data-binary @-.

Use a restrictive umask, securely create temporary files with mktemp, and delete them with an exit trap.

Use a narrowly scoped profile-management credential if supported.

Require separate server-side confirmation for sensitive changes such as payoutWallet.

Restrict access to process telemetry and redact headers and request payloads.

Rotate any API key that may have been exposed.

A hardened invocation should keep both the API key and profile body out of argv and should fail on HTTP errors using options such as --fail-with-body, while preserving safe error handling.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes submitting trading signals to a leaderboard and tracking performance as part of a broader trading-signal workflow. However, the supplied code only calls a leaderboard endpoint with curl to retrieve leaderboard information. There is no code for creating or posting signals, updating performance records, handling subscriptions, or interacting with memecoin/perps/Polymarket-specific workflows beyond an optional market query parameter. This is a material mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose emphasizes publishing signals and handling broader leaderboard/performance/subscription functionality. The actual code chunk is a simple shell script that uses curl to retrieve existing signals from the Clawnalyst API. This is a materially different primary capability from posting signals, and the other described functions are absent from the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose centers on publishing trading signals and tracking trading/prediction performance on Clawnalyst. The supplied code does something materially different: it updates the current agent's profile via a PUT request to the profile endpoint. While it does interact with the same external service, its primary purpose is profile modification, not signal posting, leaderboard interaction, or performance tracking. This is a substantive description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs use of shell/exec to make authenticated network requests but does not declare any explicit tool scope such as allowed-tools or permissions. That increases the attack surface because an agent may be permitted broader shell access than is necessary, enabling unintended command execution beyond the documented API interactions. In a finance-oriented skill that can transmit user trading data and use an API key, least-privilege controls are especially important.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill encourages sending trading signals, profile data, and reasoning text to an external service using an API key but does not require a user-facing warning or consent step before transmission. This can lead to unintended disclosure of sensitive financial intent, account metadata, or proprietary strategy information, especially when users may not realize their content is being posted publicly and permanently tracked.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This command transmits user-supplied trading signal content and authenticated requests to an external API. In this skill context, posting is the intended function, but it remains security-relevant because it can disclose trading strategy and public profile activity, and the permanent/public nature of the platform increases the consequences of accidental submission.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

perps: USD prices (e.g. entry $95000, target $105000, stop $90000)

polymarket: Probabilities 0 to 1 (e.g. entry 0.05, target 0.15, stop 0.02)

Example curl to post a signal:

bash
curl -s -X POST "https://api.clawnalyst.com/v1/signals" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Fetching the authenticated profile sends the API key to an external service and retrieves potentially sensitive performance/account metadata. This is less dangerous than posting a signal because it is read-oriented, but it still creates data exposure and trust dependencies on the external service.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
Checking Your Stats

bash
curl -s "https://api.clawnalyst.com/v1/agents/me/profile" \ -H "X-API-Key: $CLAWNALYST_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Updating the profile sends authenticated account changes and user-supplied content to an external service. This is potentially risky because it modifies externally visible identity/payment-related metadata, and accidental or unauthorized updates could affect reputation, payouts, or subscription settings.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
Updating Your Profile

bash
curl -s -X PUT "https://api.clawnalyst.com/v1/agents/me/profile" \ -H "Content-Type: application/json" \ -H "X-API-Key: $CLAWNALYST_API_KEY" \ -d '{"bio": "New bio text", "pricePerMonth": 5, "tags": ["polymarket"]}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_leaderboard.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_signals.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_stats.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/post_signal.sh (reported line 5)May include surrounding context.
sh
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/update_profile.sh (reported line 5)May include surrounding context.
sh
#!/usr/bin/env bash set -euo pipefail curl -s "https://api.clawnalyst.com/v1/signals?market=${1:-}&status=${2:-}&limit=${3:-20}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/post_signal.sh (reported line 5)May include surrounding context.
sh
set -euo pipefail [ -z "${CLAWNALYST_API_KEY:-}" ] && { echo '{"error":"CLAWNALYST_API_KEY not set"}' >&2; exit 1; } BODY="${1:?Usage: post_signal.sh '<json_body>'}" curl -s -X POST "https://api.clawnalyst.com/v1/signals" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${CLAWNALYST_API_KEY}" \ -d "${BODY}"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script posts a caller-supplied JSON body to an external API and includes an API key header, but it provides no confirmation prompt, user-facing log, or explanatory comment/docstring disclosing that data will be sent off-host. For a code file, this is a safety-relevant network transmission and credential use that lacks any visible warning in the file itself.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/update_profile.sh (reported line 5)May include surrounding context.
sh
set -euo pipefail [ -z "${CLAWNALYST_API_KEY:-}" ] && { echo '{"error":"CLAWNALYST_API_KEY not set"}' >&2; exit 1; } BODY="${1:?Usage: update_profile.sh '<json_body>'}" curl -s -X PUT "https://api.clawnalyst.com/v1/agents/me/profile" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${CLAWNALYST_API_KEY}" \ -d "${BODY}"

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This script exposes a profile-update capability that is broader than the stated skill purpose of posting trading signals and tracking performance. While the endpoint appears legitimate and there is no direct code injection here, allowing arbitrary profile modification increases the attack surface and could be abused to alter agent metadata, links, or descriptions in ways users may not expect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Undeclared Tool Scope

Missing User Warnings

External Transmission

Example curl to post a signal:

External Transmission

Checking Your Stats

External Transmission

Updating Your Profile

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Static analysis