Security audit

ClawMate Agent Skill

Security checks across malware telemetry and agentic risk

Overview

This is a real social-network skill, but it gives an agent broad account authority and includes an optional external webhook that needs careful review before use.

Install only if you intentionally want an agent to act on a ClawMate account. Keep the token private, pin the API base to the official service, and require explicit human approval for posting, DMs, follows, profile/personality changes, deletions, and webhook setup. Do not enable the webhook unless the endpoint is trusted, secured, and intended to receive account event data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The webhook feature extends the skill from local/social interaction into forwarding platform events to an arbitrary external server. That creates a real data-exfiltration and trust-boundary risk because notifications and user interaction metadata may be transmitted off-platform without strong guidance on endpoint trust, authentication, or minimization.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs loading a local .env file containing an API token and then using that credential in shell commands. While using credentials is necessary for API access, directing an agent to source local secrets increases the chance of unnecessary secret exposure, misuse, or leakage through logs, command history, or prompt/context handling if not tightly constrained.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The skill includes an endpoint to fully change the agent's display name, avatar, bio, and personality, which materially alters identity and behavior beyond routine social participation. If used unexpectedly or without explicit approval, this can enable impersonation, persistence changes, or reputational harm that outlast a single session.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README promotes public social actions such as posting, commenting, joining circles, and agent-to-agent conversations, but it does not clearly warn that content may be publicly visible, logged, retained, or shared with other users and systems. For an agent skill, this omission can lead operators to connect agents that disclose sensitive prompts, personal data, internal state, or proprietary information into a public social environment without informed consent or safeguards.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation tells the agent to read and use a sensitive API token from a local .env file but does not provide an explicit warning about secret handling. That omission matters because users may not realize the token should be protected from logs, shell history, debugging output, or reuse with untrusted endpoints.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill exposes delete-post and delete-comment operations without requiring confirmation or warning about irreversibility. In an autonomous or semi-autonomous setting, that raises the risk of accidental destructive actions, content loss, and abuse by prompt injection or misinterpretation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Webhook configuration sends platform events to an external endpoint, but the documentation lacks an explicit privacy/security warning about what data leaves the platform and whether the destination can be trusted. This can expose conversation or interaction metadata to third parties and expand the attack surface via insecure receivers.

Ssd 4

Medium

Confidence: 77% confidence
Finding: The skill explicitly frames the agent as a long-term social participant whose objective includes building relationships and reciprocal interactions. In isolation that is product-aligned, but in a security context it operationalizes social engineering behavior by encouraging trust cultivation with other users over time.

Ssd 4

Medium

Confidence: 84% confidence
Finding: The documented escalation path from browsing to comments, follows, DM requests, and deep conversation provides a concrete playbook for gradually moving users from public to private interaction. Even with consent language elsewhere, this kind of staged progression can facilitate social engineering and targeted influence campaigns.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.