ClawHub
Back to skill

Security audit

ClawRTC

Security checks for vulnerabilities and agentic risk

Overview

This is a real mining and wallet skill, but its code contradicts its privacy and TLS promises in ways users should review before installing.

Install only if you intentionally want to run a crypto miner and are comfortable with wallet-linked hardware fingerprinting. Before using it, review the plaintext miner endpoint, hidden install telemetry, MAC/hostname collection, cloud metadata probes, optional auto-start service, and BCOS admin-key path. Avoid running it on cloud hosts or machines with sensitive credentials, and do not use BCOS certification/admin keys until TLS verification and disclosure issues are fixed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

other

Warning
Location
clawrtc/cli.py:320
Finding

Undisclosed third-party installation telemetry contradicts the privacy disclosure

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
clawrtc/data/miner.py:376
Finding

Hostname, MAC addresses, wallet identifiers, and hardware fingerprints are transmitted over plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
clawrtc/cli.py:918
Finding

BCOS certification disables TLS verification while transmitting an administrator credential

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
clawrtc/data/fingerprint_checks.py:435
Finding

Hardware fingerprinting actively probes the cloud metadata service and requests an AWS IMDSv2 token

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
clawrtc/cli.py:747
Finding

RTC wallet exports containing private keys are created without restrictive permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
clawrtc/cli.py:46
Finding

Standard installation omits strong signing modules and silently falls back to a legacy pseudo-signature

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Note
Location
clawrtc/cli.py:375
Finding

Optional persistent mining services continuously transmit host data after login or reboot

Content
View full analysis
/dev/null', check=False) run_cmd(f'launchctl load "{plist_file}"') success("LaunchAgent installed and loaded (auto-restarts on login)") except Exception: warn("Could not load LaunchAgent. Use: clawrtc start") ``` ### Technical Analysis When the user supplies `--service`, the package creates either a systemd user service or macOS LaunchAgent. Both mechanisms survive the immediate command invocation and automatically restart the miner. The persistence itself is consistent with an explicitly requested background miner and is not covert: installation only calls these functions when `--service` is ...[truncated 1401 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (100)

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · clawrtc/cli.py (reported line 313)May include surrounding context.

python
try:
        import urllib.request
        req = urllib.request.Request(f"{NODE_URL}/api/miners")
        with urllib.request.urlopen(req, timeout=10) as resp:
            miners = json.loads(resp.read())
            log(f"Active miners on network: {len(miners)}")
    except Exception:

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · clawrtc/cli.py (reported line 552)May include surrounding context.

python
try:
        import urllib.request
        req = urllib.request.Request(f"{NODE_URL}/api/miners")
        with urllib.request.urlopen(req, timeout=10) as resp:
            miners = json.loads(resp.read())
            log(f"Active miners on network: {len(miners)}")
    except Exception:

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · clawrtc/cli.py (reported line 733)May include surrounding context.

python
try:
        import urllib.request
        req = urllib.request.Request(f"{NODE_URL}/api/miners")
        with urllib.request.urlopen(req, timeout=10) as resp:
            miners = json.loads(resp.read())
            log(f"Active miners on network: {len(miners)}")
    except Exception:

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · clawrtc/cli.py (reported line 336)May include surrounding context.

python
data=payload,
                    headers={"Content-Type": "application/json"}
                )
                urllib.request.urlopen(req, timeout=5)
            except Exception:
                pass
        threading.Thread(target=_ping, daemon=True).start()

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

BCOS verification disables TLS certificate and hostname validation before fetching purported verification data. A man-in-the-middle can spoof the server response and make untrusted certificates appear verified, undermining the security promise of the verification feature.

Content

Scanner excerpt · clawrtc/cli.py (reported line 854)May include surrounding context.

python
ctx.verify_mode = ssl.CERT_NONE

        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, context=ctx, timeout=15) as resp:
            data = json.loads(resp.read().decode())

        if not data.get("ok"):

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
99% confidence
Finding

This request sends an admin key in the X-Admin-Key header while TLS verification is explicitly disabled. An active network attacker can intercept the key, modify the attestation request, or impersonate the server, leading to credential theft and unauthorized certification actions.

Content

Scanner excerpt · clawrtc/cli.py (reported line 950)May include surrounding context.

python
},
            method="POST",
        )
        with urllib.request.urlopen(req, context=ctx, timeout=30) as resp:
            data = json.loads(resp.read().decode())

        if data.get("ok"):

Tainted flow: 'req' from os.environ.get (line 941, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The certificate PDF is downloaded with TLS verification disabled, allowing content spoofing or malicious file substitution. While less severe than admin-key exposure, it can still mislead users or deliver untrusted artifacts presented as official certificates.

Content

Scanner excerpt · clawrtc/cli.py (reported line 972)May include surrounding context.

python
ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE

        with urllib.request.urlopen(req, context=ctx, timeout=30) as resp:
            pdf_data = resp.read()

        out_path = os.path.join(path, f"{cert_id}.pdf")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using subprocess.run with shell=True in a shared helper is a classic unsafe default because future and current callers can pass interpolated strings that the shell will parse. In this file, command strings include quoted paths and generated values, so an attacker controlling environment-derived paths or arguments may achieve command execution.

Content

Scanner excerpt · clawrtc/cli.py (reported line 88)May include surrounding context.

python
def run_cmd(cmd, check=True, capture=False):
    """Run a shell command."""
    try:
        result = subprocess.run(
            cmd, shell=True, check=check,
            capture_output=capture, text=True
        )

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The consent text explicitly claims data is sent only to the RustChain node, but installation also silently sends telemetry to bottube.ai. Misrepresenting outbound data flows is dangerous because it defeats informed consent and is a strong trust violation, especially in an installer that already requests persistence and network access.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · clawrtc/cli.py (reported line 495)May include surrounding context.

python
wallet = open(wallet_file).read().strip() if os.path.exists(wallet_file) else ""
    log(f"Starting miner in foreground (Ctrl+C to stop)...")
    log(f"Tip: Use 'clawrtc start --service' for background auto-restart")
    os.execvp(python_bin, [python_bin, miner_py] + (["--wallet", wallet] if wallet else []))


def cmd_mine(args):

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · clawrtc/cli.py (reported line 566)May include surrounding context.

python
if system == "Linux":
        sf = os.path.expanduser("~/.config/systemd/user/clawrtc-miner.service")
        if os.path.exists(sf):
            os.execlp("journalctl", "journalctl", "--user", "-u", "clawrtc-miner", "-f", "--no-pager", "-n", "50")
        else:
            log_file = os.path.join(INSTALL_DIR, "miner.log")
            if os.path.exists(log_file):

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · clawrtc/cli.py (reported line 570)May include surrounding context.

python
else:
            log_file = os.path.join(INSTALL_DIR, "miner.log")
            if os.path.exists(log_file):
                os.execlp("tail", "tail", "-f", log_file)
            else:
                warn("No logs found. Start the miner first: clawrtc start")
    elif system == "Darwin":

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · clawrtc/cli.py (reported line 576)May include surrounding context.

python
else:
            log_file = os.path.join(INSTALL_DIR, "miner.log")
            if os.path.exists(log_file):
                os.execlp("tail", "tail", "-f", log_file)
            else:
                warn("No logs found. Start the miner first: clawrtc start")
    elif system == "Darwin":

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI's stated purpose is mining/attestation, yet it also includes a BCOS repo scanner, certificate generation, admin-key handling, and network upload workflow. This scope expansion increases attack surface, introduces credential-handling paths unrelated to the advertised function, and makes the package more dangerous in agent contexts where users may not expect these capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

BCOS certification reads an admin key from an environment variable or local file and transmits it in an HTTP header without clear user-facing warning. In a skill/agent context, silent credential use is risky because operators may not realize a local secret will be sent over the network, and elsewhere this flow is further weakened by disabled TLS checks.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · clawrtc/coinbase_wallet.py (reported line 188)May include surrounding context.

python
def coinbase_swap_info(args):
    """Show USDC→wRTC swap instructions and Aerodrome pool info."""
    print(f"""
  {GREEN}{BOLD}USDC → wRTC Swap Guide{NC}

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawrtc/coinbase_wallet.py (reported line 215)May include surrounding context.

python
5. Bridge wRTC to native RTC at https://bottube.ai/bridge

  {DIM}Or use the RustChain API:{NC}
    curl -s https://bulbous-bouffant.metalseed.net/wallet/swap-info
""")

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

This finding points to documentation/comments describing intentional access to the cloud metadata endpoint, which reinforces that the later network behavior is deliberate rather than incidental. While the comment itself is not executable, in context it signals a design that treats privileged instance-local metadata probing as acceptable, increasing the severity of the implemented requests.

Content

Scanner excerpt · clawrtc/data/fingerprint_checks.py (reported line 317)May include surrounding context.

python
- VMware, VirtualBox, KVM, QEMU, Xen, Hyper-V, Parallels
    - AWS EC2 (Nitro/Xen), GCP, Azure, DigitalOcean
    - Linode, Vultr, Hetzner, Oracle Cloud, OVH
    - Cloud metadata endpoints (169.254.169.254)

    Updated 2026-02-21: Added cloud provider detection after
    discovering AWS t3.medium instances attempting to mine.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The anti-emulation routine actively probes the cloud metadata service at 169.254.169.254, which goes beyond passive hardware fingerprinting and introduces network-discovery behavior. In cloud environments this can contact sensitive instance-local services and may retrieve provider-identifying data or tokens, creating SSRF-like access to privileged metadata endpoints without user consent.

Content

No source excerpt is available for this finding.

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
98% confidence
Finding

The code constructs an HTTP request to http://169.254.169.254/, a well-known cloud metadata address reachable only from the local host environment. Contacting this special endpoint is SSRF-like behavior against a privileged local service and can leak provider or instance metadata that should not be queried by an unrelated fingerprint routine.

Content

Scanner excerpt · clawrtc/data/fingerprint_checks.py (reported line 436)May include surrounding context.

python
pass

    # --- Cloud metadata endpoint check ---
    # AWS, GCP, Azure, DigitalOcean all use 169.254.169.254
    try:
        import urllib.request
        req = urllib.request.Request(

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
99% confidence
Finding

This literal metadata URL is used in a live request, making it a concrete privileged local-service access path. In cloud environments, metadata endpoints can expose sensitive information about the instance and role configuration, so probing them from application code materially increases risk.

Content

Scanner excerpt · clawrtc/data/fingerprint_checks.py (reported line 440)May include surrounding context.

python
try:
        import urllib.request
        req = urllib.request.Request(
            "http://169.254.169.254/",
            headers={"Metadata": "true"}
        )
        resp = urllib.request.urlopen(req, timeout=1)

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
99% confidence
Finding

The IMDSv2 token request targets AWS's protected metadata token endpoint, which is especially sensitive because successful token acquisition can be a precursor to broader metadata access. Even though this code only checks for status 200, it still performs an unauthorized probe against a privileged cloud control surface unrelated to local hardware validation.

Content

Scanner excerpt · clawrtc/data/fingerprint_checks.py (reported line 458)May include surrounding context.

python
try:
        import urllib.request
        token_req = urllib.request.Request(
            "http://169.254.169.254/latest/api/token",
            headers={"X-aws-ec2-metadata-token-ttl-seconds": "5"},
            method="PUT"
        )

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High
Category
YARA Match
Confidence
99% confidence
Finding

The file is explicitly a cryptocurrency miner with dual-mining support and detection of xmrig/zephyrd, not merely an incidental reference. In an agent-skill ecosystem, embedded cryptomining logic is highly dangerous because it can abuse host CPU resources, generate unauthorized network traffic, and pair naturally with the undisclosed telemetry and insecure remote communications present elsewhere in the file.

Content

Scanner excerpt · clawrtc/data/miner.py (reported line 6)May include surrounding context.

python
#!/usr/bin/env python3
"""
RustChain Windows Wallet Miner
Full-featured wallet and miner for Windows

Includes Zephyr (RandomX) dual-mining integration.
See: https://github.com/Scottcjn/rustchain-bounties/issues/461
"""

import os
import sys
import time
import json
import hashlib
import platform
import threading
import statistics
import uuid
import subprocess
import re
try:
    import tkinter as tk
    from tkinter import ttk, messagebox, scrolledtext
    TK_AVAILABLE = True
    _TK_IMPORT_ERROR = ""
except Exception as e:
    TK_AVAILABLE = False
    _TK_IMPORT_ERROR = str(e)
    tk = None
    ttk = None
    messagebox = None
    scrolledtext = None
import requests
from datetime import datetime
from pathlib i

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The miner automatically sends attestation and enrollment-related data to remote endpoints with no meaningful user-facing disclosure or informed consent. This is particularly dangerous here because the file is not a generic admin tool but a crypto-mining client that starts repeated background network communication to a hard-coded node, making covert telemetry and wallet-associated tracking plausible.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The attestation payload includes sensitive hardware identifiers such as MAC addresses, hostname, CPU details, architecture, and device model, which can be used to fingerprint a user across installs and networks. In this skill's context—a cryptocurrency miner that silently phones home to a hard-coded external node over HTTP—this collection is especially dangerous because it enables persistent device tracking and deanonymization without meaningful user awareness or consent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: malicious.crypto_mining, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal (+1 more)

Possible crypto mining behavior detected.

Critical
Code
malicious.crypto_mining
Location
clawrtc/data/miner.py:86

Possible crypto mining behavior detected.

Critical
Code
malicious.crypto_mining
Location
clawrtc/data/pow_miners.py:24

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
clawrtc/cli.py:815

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
clawrtc/cli.py:649

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
clawrtc/cli.py:502