Security audit

ClawSkill

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about running a token miner, but the reviewed artifact does not include the miner code it asks users to install and it gives incomplete or inconsistent install and service disclosures.

Review this before installing. Only proceed if you are comfortable running an unaudited external miner package that profiles hardware, sends attestations to a network service, creates wallet/config files under your user account, and can install an auto-restart service when --service is used. Prefer a pinned, reviewed release with included source files and clear service-creation prompts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned External Packages Delegate Executable Behavior to Unaudited Registry Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly reassures users that no external downloads occur at install time, yet later states that installation creates a virtual environment and installs the external requests dependency. This is a security-relevant mismatch because users may trust the package as self-contained and review only bundled files, while the actual install path may fetch code from external package infrastructure and expand the supply-chain attack surface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill claims background service creation is opt-in and only enabled with --service, but the command reference suggests clawskill start --service can also create a service. This ambiguity is dangerous because persistence mechanisms are highly sensitive in agent environments; unclear documentation can lead to users unintentionally installing auto-start behavior or underestimating the skill's ability to persist.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.