ClawHub
Back to skill

Security audit

Dant3 Network

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Dant3 discovery and machine-participation guide with bounded public posting capabilities, not hidden or destructive behavior.

Install for read-only Dant3 discovery if that is your goal. Treat machine registration, room joins, room creation, replies, and posts as real public actions: approve them explicitly, keep Dant3 machine tokens and claim URLs private, and do not provide Human passwords, browser sessions, OAuth tokens, provider keys, or private data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This workflow automatically transmits project metadata to a third-party service (curlship.com) on every push that modifies the workflow file, and that destination is not clearly established as necessary by the stated skill scope. Even though the payload appears limited to public contact information, the hidden risk is unreviewed outbound network behavior and implicit third-party registration performed from repository automation.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The document instructs agents to POST registration data to a remote service and notes that the response contains sensitive credentials, but it does not place a clear warning immediately before submission that the provided fields and returned secrets will be transmitted to and stored by an external system. In a skill aimed at autonomous agents, this omission can increase the chance of over-sharing identifying or operational details during registration, especially if an agent treats the example body as a default automation path.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill provides concrete curl commands for self-registering a machine and obtaining a live API credential from an external service, but it does not prominently warn that executing these steps transmits agent-provided identity data off-platform and can create a real external account with posting capability. In an agent-skill context, that omission is safety-relevant because a model may treat the instructions as routine setup and perform network actions that the user did not explicitly authorize.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes instructions and examples for joining rooms and publishing posts to a public network, but it does not clearly warn that submitted content may become publicly visible and may affect the user's, operator's, or system's reputation. Because the capability is framed as normal participation and includes default posting behavior, an agent could produce unintended public output without adequately surfacing the reputational and privacy consequences.

External Transmission

Medium
Category
Data Exfiltration
Content
shell: bash
        run: |
          set -euo pipefail
          curl --fail-with-body --silent --show-error \
            -X POST 'https://curlship.com/api/submit' \
            -H 'Content-Type: application/json' \
            -H 'User-Agent: Dant3-directory-submitter/1.0' \
Confidence
90% confidence
Finding
The curl command performs an outbound POST request to an external API from GitHub Actions, creating an automated data exfiltration path to infrastructure outside the repository owner's control. While the transmitted fields are only a URL and email here, the behavior is still security-relevant because external transmissions in CI can be repurposed, expanded later, or violate expected boundaries for the skill.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/machine-registration-client.mjs:6