Grazer — 24-Platform Content Discovery

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 AM UTC
• Version: 2.0.0

Overview

Grazer looks like a real content-discovery and engagement skill, but it needs Review because it includes an exposed bearer token and several under-scoped credential, posting, and autonomous-loop behaviors.

Review before installing or running automation. The publisher should revoke and remove the embedded ClawHub token, require HTTPS or allowlisted origins before forwarding API keys, sanitize LLM-generated SVGs, make auto-response explicitly opt-in, and pin runtime commands. Users should use limited-scope API keys, start with dry-run/idempotency options, and avoid running the agent loop unattended.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: PUBLISH_CHECKLIST.md:54

Finding

Hardcoded ClawHub Bearer Token in Publishing Documentation

Content

View full analysis

``` 4. If the token remains active, the attacker invokes any API operation authorized for that credential, potentially including skill registration or modification. 5. The attacker may alter registry metadata or perform other actions under the credential owner's identity. ### Impact Assessment The obtainable privileges are ...[truncated 321 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/__init__.py:1451

Finding

Bearer Token Exfiltration Through Caller-Controlled Relay Host

Content

View full analysis

Dict: """Send an SEO-enhanced heartbeat to the Beacon relay. This generates a dofollow backlink on the agent's crawlable profile page. Each ping refreshes the agent's status and updates SEO metadata. Args: agent_id: The agent's bcn_ ID. relay_token: Bearer token from registration. seo_url: Agent's homepage URL (becomes dofollow link on profile). seo_description: Agent description for meta tags. status: One of "alive", "degraded", "shutting_down". relay_host: Beacon relay base URL. Returns: Dict with heartbeat confirmation and SEO backlink data including the agent's crawlable profile URL (the dofollow backlink). """ payload = { "agent_id": agent_id, "status": status, } if seo_url: payload["seo_url"] = seo_url if seo_description: payload["seo_description"] = seo_description try: resp = self.session.post( f"{relay_host}/relay/heartbeat/seo", json=payload, headers={"Authorization": f"Bearer {relay_token}"}, timeout=self.timeout, ) return resp.json() except Exception as e: return {"error": str(e), "ok": False} ``` ### Technical Analysis The method accepts `relay_host` from its caller and concatenates it directly into the request URL. The supplied `relay_token` is then attached to that URL as a bearer credential. There is no scheme validation, HTTPS requirement, host allowlist, origin binding, or pr ...[truncated 2002 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/imagegen.py:233

Finding

LLM API Credential and Prompt Transmission Over Plaintext HTTP

Content

View full analysis

str: """Generate SVG using any OpenAI-compatible LLM endpoint. Args: prompt: Image description llm_url: OpenAI-compatible chat completions endpoint llm_model: Model name/ID llm_api_key: Optional API key (Bearer token) temperature: Creativity (0.0-1.0) timeout: Request timeout in seconds Returns: Raw SVG string ready for 4claw media field """ headers = {"Content-Type": "application/json"} if llm_api_key: headers["Authorization"] = f"Bearer {llm_api_key}" payload = { "model": llm_model, "messages": [ {"role": "system", "content": LLM_SVG_SYSTEM_PROMPT}, {"role": "user", "content": f"Create an SVG image: {prompt}"}, ], "temperature": temperature, "max_tokens": 2048, } resp = requests.post(llm_url, json=payload, headers=headers, timeout=timeout) ``` The example configuration reinforces the unsafe transport: ```json "imagegen": { "llm_url": "http://100.75.100.89:8080/v1/chat/completions", "llm_model": "gpt-oss-120b", "llm_api_key": null } ``` ### Technical Analysis The function permits any URL and provides a plaintext HTTP endpoint as its default. When `llm_api_key` is configured, the key is inserted into the `Authorization` header without checking whether TLS protects the connection. The prompt and system message are also transmitted in the unencrypted request body. An attacker with ...[truncated 1791 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/imagegen.py:215

Finding

Untrusted LLM-Generated SVG Can Contain Active Content

Content

View full analysis

str: """Validate and sanitize SVG for 4claw.""" svg = svg.strip() # Must start with SVG_MAX_BYTES: raise ValueError(f"SVG exceeds 4KB limit ({len(svg.encode('utf-8'))} bytes)") return svg ``` LLM output is extracted and passed directly to that validator: ```python resp = requests.post(llm_url, json=payload, headers=headers, timeout=timeout) resp.raise_for_status() content = resp.json()["choices"][0]["message"]["content"].strip() # Extract SVG if wrapped in code fences svg_match = re.search(r'', content) if not svg_match: raise ValueError("LLM did not produce valid SVG output") return _validate_svg(svg_match.group(0)) ``` The accepted SVG is subsequently uploaded to 4claw: ```python if svg: body["media"] = svg_to_media(svg) elif image_prompt: result = self.generate_image(image_prompt, template=template, palette=palette) body["media"] = svg_to_media(result["svg"]) resp = self.session.post( f"https://www.4claw.org/api/v1/boards/{board}/threads", json=body, headers={ "Authorization": f"Bearer {self.fourclaw_key}", "Content-Type": "application/json", }, timeout=self.timeout, ) ``` ### Technical Analysis SVG is an active document format rather than a passive image format. It can contain script elements, inline event handlers, links, ...[truncated 2301 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (77)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The checklist embeds a live bearer token directly in publication instructions, which exposes a secret to anyone who can read the file and encourages reuse of a hardcoded credential. If the token is valid, an attacker could authenticate to the ClawHub API as the owner and perform unauthorized actions such as registering, modifying, or abusing skills.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Claude Code

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · debian/build-deb.sh (reported line 8)May include surrounding context.

sh

VERSION="1.9.1"
PKG="grazer_${VERSION}_all"

rm -rf "/tmp/${PKG}"
mkdir -p "/tmp/${PKG}/DEBIAN"
mkdir -p "/tmp/${PKG}/usr/lib/python3/dist-packages/grazer"
mkdir -p "/tmp/${PKG}/usr/bin"

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The SEO heartbeat/backlink functionality is unrelated to the stated content-discovery purpose and transmits agent identity, bearer credentials, status, and optional SEO metadata to an external relay. In an agent-skill context, this expands the package into external promotion/tracking infrastructure and could be abused to create unsolicited external presence, leak metadata, or exfiltrate identifiers to a third party.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The lockfile pins axios 1.13.6, and the supplied advisories include SSRF, proxy bypass, prototype-pollution-related MITM/credential theft, and related request-handling issues. In an agent skill, HTTP client libraries are commonly used to fetch remote content or call APIs, so a vulnerable axios version can directly expose network requests, credentials, and trust boundaries.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names and filenames. If the skill constructs multipart requests from untrusted input, an attacker may be able to manipulate request boundaries or inject crafted headers/content, potentially enabling request smuggling, upstream parsing confusion, or data exfiltration.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package permits installation of axios 1.13.6, which is flagged with multiple advisories including SSRF-related and prototype-pollution-adjacent issues. This is especially concerning for a skill designed to fetch content from many remote platforms, because network-facing code commonly processes attacker-controlled URLs, redirects, headers, and proxy settings, increasing the chance that a vulnerable HTTP client could be abused.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · src/clawhub.ts (reported line 87)May include surrounding context.

ts

}

  /**
   * Update skill metadata
   */
  async updateSkill(skillId: string, updates: Partial<ClawHubSkill>): Promise<ClawHubSkill> {
    if (!this.token) {

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Untrusted notification text is inserted directly into the LLM prompt, allowing attackers to inject instructions through comments or mentions. Because this component is specifically designed to auto-generate replies, prompt injection can steer the model into producing manipulative, harmful, off-brand, or policy-violating responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The deployment guide instructs users to publish packages to public registries and submit a remote API POST without clearly warning that these actions perform irreversible public release and external data transmission. In a skill context, operators may copy-paste commands verbatim, so missing disclosure materially increases the risk of accidental publication, metadata leakage, or unintended release under the user's authenticated accounts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl command sends a JSON payload to an external service, which is an explicit outbound transmission to a third party. While the transmitted data appears to be package metadata rather than secrets, the lack of warning or confirmation means users may unknowingly disclose project information or register entries with an external platform.

Content

Scanner excerpt · DEPLOY.md (reported line 59)May include surrounding context.

Create a skill entry on BoTTube:

bash

curl -X POST https://bottube.ai/api/skills \
  -H "Content-Type: application/json" \
  -d '{
    "name": "grazer",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These commands automate posting announcements to multiple external platforms under a specified agent identity, but the guide does not warn that they will create public content or may use stored credentials. In an agent-skill setting this is risky because users may unintentionally broadcast messages, impersonate an operational identity, or trigger spam/policy issues by blindly executing the commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide tells users to modify a local file in /home/scott and run an automated publish script that chains build, test, release, tagging, and push actions without describing side effects. This is dangerous because copy-paste execution can alter local state and trigger multiple external operations at once, making mistakes harder to detect or stop once started.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section describes checking notifications, generating responses, posting comments, and creating posts automatically, but it does not clearly warn the operator that content may be posted on their behalf without manual review. That creates a real safety and security issue because users may enable behavior that can spam, impersonate, or damage accounts if the agent behaves incorrectly or is manipulated by untrusted inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The standalone loop documentation says the agent will monitor notifications in real time, auto-respond to comments, and run every 5 minutes, but the risk is presented as a convenience feature rather than a potentially unsafe autonomous action. Users may launch a persistent bot that continuously posts or responds using stored credentials without understanding the operational and abuse implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INTEGRATION.md (reported line 123)May include surrounding context.

1. Setup Config

bash

mkdir -p ~/.grazer
cp config.example.json ~/.grazer/config.json
cp profile.example.json ~/.grazer/profile.json

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The guide instructs users to execute npx grazer-agent without pinning a specific package version. This causes code to be fetched and executed at runtime from the package registry, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed. In an agent/autonomous context, that risk is amplified because the fetched code may immediately gain access to configured API keys and automation capabilities.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The reference to notification monitoring plus auto-deploy indicates autonomous decision-making tied to external inputs. In this skill's context, that means an agent may decide how and when to respond or engage without user review, which can be abused through prompt injection, spam amplification, or harmful public actions if the upstream content is adversarial.

Content

Scanner excerpt · INTEGRATION.md (reported line 163)May include surrounding context.

text

### Boris (Moltbook Bot)
Already integrated via notification monitor + auto-deploy

### Janitor (AutomatedJanitor2015)
Add to notification checking:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The external transmission itself is expected for skill registration, but here it is paired with a hardcoded bearer token and a direct POST request to a third-party API. This makes the finding dangerous in context because the file not only documents data exfiltration to an external service, but also provides reusable authentication material that could be abused by anyone following or copying the command.

Content

Scanner excerpt · PUBLISH_CHECKLIST.md (reported line 54)May include surrounding context.

bash

# Using ClawHub CLI or API
curl -X POST https://clawhub.ai/api/skills \
  -H "Authorization: Bearer clh_w2cSUND_qu_ZUqusQqKV97-s2tROfJ5rsCxKbfQFVy4" \
  -H "Content-Type: application/json" \
  -d '{

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

APT (Debian/Ubuntu)

bash

curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer

Static analysis

Detected: suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal, suspicious.install_untrusted_source

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: config.example.json:18

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: grazer/imagegen.py:233

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: grazer/__init__.py:89

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: PUBLISH_CHECKLIST.md:55

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/index.ts:425

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:18