Clawkeep

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:02 PM UTC
• Version: 0.2.9

Overview

The skill is a coherent backup tool, but it asks users to install an unaudited global CLI, run persistent backup services, and handle cloud credentials in ways that need careful review.

Install only if you trust the `clawkeep` npm package and understand it will read, snapshot, restore, and potentially sync broad workspace contents. Pin and verify the CLI version where possible, use least-privilege S3/API keys, avoid putting real secrets directly on command lines, test restore into a separate directory first, and stop/remove any watch, UI, or PM2 daemon when it is no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–15 **Additional Locations**: `clawkeep-cloud/SKILL.md`, lines 11–14; `local/SKILL.md`, lines 12–15; `s3/SKILL.md`, lines 12–15 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash ## Prerequisites ClawKeep must be installed globally: ```bash npm install -g clawkeep ``` Verify: `clawkeep --version` ``` ### Technical Analysis The documentation directs users to globally install the latest available version of the `clawkeep` npm package. It does not specify an exact version, package integrity hash, lockfile, provenance requirement, or other mechanism for ensuring that the installed package is the version that was reviewed. A global npm installation can execute package installation scripts and makes the resulting executable available system-wide for the current environment. Consequently, a compromised maintainer account, malicious package release, or unexpected upstream change could cause users to execute code that was not represented in the audited project. The supplied project contains only Markdown skill instructions and no implementation of the `clawkeep` package. Therefore, the package's encryption, credential storage, network behavior, and installation scripts cannot be independently verified from this artifact. ### Attack Path 1. An attacker compromises the upstream npm package, its maintainer account, or its publication pipeline. 2. The attacker publishes a malicious version under the legitimate `clawkeep` package name. 3. A user follows the documented `npm install -g clawkeep` instruction. 4. npm downloads the current malicious release and may execute its lifecycle scripts. 5. The installed CLI runs with the invoking user's privileges and can access files, environment variables, configuration, and backup credentials available to that user. ### Impact Assessment Successful exploitation could provide ...[truncated 756 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installation to an exact, reviewed version, for example: ```bash npm install -g clawkeep@X.Y.Z ``` 2. Publish and verify package integrity and provenance information, including npm provenance attestations and release checksums. 3. Prefer a project-local installation with a committed lockfile instead of a global installation where practical. 4. Disable lifecycle scripts during installation unless they are necessary and have been reviewed: ```bash npm install --ignore-scripts clawkeep@X.Y.Z ``` 5. Document the expected package publisher, registry, version, and integrity value. 6. Include or link to the auditable source corresponding exactly to the pinned release. 7. Run the CLI under a dedicated least-privileged account with access only to the workspace and backup resources it requires. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: s3/SKILL.md:20
• Finding: S3 and Cloud Credentials Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `s3/SKILL.md`, lines 20–29 **Additional Locations**: `s3/SKILL.md`, lines 52–63, 111–119, 123–131, 135–143, and 147–155; `clawkeep-cloud/SKILL.md`, lines 64–69 **Vulnerability Type**: Sensitive credentials passed as process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # Configure S3-compatible target clawkeep backup s3 \ --endpoint https://your-account.r2.cloudflarestorage.com \ --bucket my-backups \ --access-key YOUR_ACCESS_KEY \ --secret-key YOUR_SECRET_KEY \ --region auto \ --prefix clawkeep/ \ -d /path/to/workspace ``` The Cloud setup instructions similarly recommend passing an API key as an argument: ```bash # Use API key + workspace (password still set via browser first) clawkeep cloud setup --api-key ck_live_xxxxx --workspace ws_xxxxx ``` ### Technical Analysis The documented commands encourage users to replace placeholders with real access keys and secret keys directly in the command line. Command-line arguments are not a protected secret-input channel. Depending on the operating system and shell configuration, secrets supplied this way may be exposed through: - Shell history files. - Process listings and process inspection interfaces while the command is running. - Process-monitoring or endpoint-management software. - Terminal session recordings. - Diagnostic bundles and support logs. - Automation logs when the commands are run in CI or agent startup scripts. Although the S3 skill also documents environment variables, the inline credential form appears in the quick setup, full setup, provider examples, and agent integration sections. This makes insecure secret handling a prominent and repeatable configuration pattern. ### Attack Path 1. A user replaces `YOUR_SECRET_KEY`, `ck_live_xxxxx`, or another placeholder with a valid credential. 2. The user executes the documented command in an interactive shell, startup script, CI job, or agent process. 3. The command ...[truncated 1161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove secret-bearing command-line examples from quick-start and provider documentation. 2. Have the CLI request secrets through a non-echoing interactive prompt or protected standard input. 3. Support OS-native secret stores such as macOS Keychain, Windows Credential Manager, or Linux Secret Service. 4. For unattended execution, support credential files with restrictive permissions and reject files that are readable by other users. 5. Prefer short-lived, automatically rotated credentials obtained through provider identity mechanisms such as AWS IAM roles or workload identity. 6. If environment variables remain supported, warn that they can still be exposed through process environments, crash reports, and CI logging. 7. Configure least-privilege S3 policies restricted to the required bucket and prefix. 8. Add documentation for clearing affected shell history and rotating any credential previously entered on a command line. 9. Ensure the CLI redacts secrets from logs, errors, status output, telemetry, and generated configuration diagnostics. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: s3/SKILL.md:145
• Finding: Plaintext HTTP MinIO Endpoint Documented Alongside Storage Credentials<![CDATA[ ## Vulnerability Details **File Location**: `s3/SKILL.md`, lines 145–155 **Vulnerability Type**: Insecure transport configuration for an S3-compatible endpoint **Risk Level**: Medium ### Vulnerable Code ```bash ### MinIO (Self-Hosted) ```bash clawkeep backup s3 \ --endpoint http://localhost:9000 \ --bucket my-backups \ --access-key <MINIO_ACCESS_KEY> \ --secret-key <MINIO_SECRET_KEY> \ --region us-east-1 \ -d /path/to/workspace ``` ``` ### Technical Analysis The MinIO example uses an unencrypted `http://` endpoint while also supplying access and secret keys. Although the example specifically uses `localhost`, users may copy the configuration and replace `localhost` with a remote hostname or private-network address without enabling TLS. S3 request-signing mechanisms do not provide the confidentiality and full transport protection supplied by TLS. An attacker with a suitable network position may observe request details, collect authentication material useful for replay or offline analysis, interfere with responses, or manipulate traffic. Client-side encryption of backup chunks does not secure storage credentials or all protocol metadata in transit. The documentation does not clearly restrict this HTTP example to loopback-only development use, require HTTPS for remote MinIO servers, or state that certificate validation must remain enabled. ### Attack Path 1. A user copies the documented MinIO example. 2. The user replaces `localhost` with a remote MinIO server or exposes the local service over a shared network while retaining `http://`. 3. Backup operations transmit S3-compatible requests over a plaintext connection. 4. An attacker positioned on the same network, gateway, proxy, or routing path observes or modifies the traffic. 5. The attacker attempts to replay captured requests, interfere with backup operations, redirect traffic, or leverage exposed information to access the object store. 6. If storage access is obtained, the attack ...[truncated 834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the primary MinIO example with an HTTPS endpoint: ```bash clawkeep backup s3 \ --endpoint https://minio.example.com \ --bucket my-backups \ --region us-east-1 \ -d /path/to/workspace ``` 2. Clearly label plaintext HTTP as suitable only for isolated loopback development and never for remote or shared-network deployments. 3. Make the CLI reject plaintext endpoints whose host is not a loopback address unless the user supplies an explicit high-friction development override. 4. Require valid TLS certificates and do not recommend disabling certificate verification. 5. Document secure MinIO TLS configuration, certificate rotation, and private certificate-authority trust setup. 6. Avoid placing MinIO credentials directly in command-line arguments; use a protected credential mechanism. 7. Restrict MinIO credentials to the required bucket, prefix, and operations, and rotate credentials after suspected interception. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

## Prerequisites

1. ClawKeep CLI installed (`npm install -g clawkeep`)
2. An S3-compatible bucket with access credentials

## Quick Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs users to run initialization and a background watch daemon that continuously modifies the target workspace by creating backup metadata, commits, and synchronizing ignore files, but it does not prominently warn that these are persistent write operations. In a backup/versioning skill, this omission is risky because users may apply it to sensitive or already-managed repositories and unintentionally alter workspace state, history, or ignore behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The dashboard command starts a local service that exposes workspace history and file contents through a browser-accessible interface, yet the skill does not clearly warn about the trust boundary or local exposure. Even with token-based auth, users should be told that a listening service is being launched and that binding, port exposure, and token handling affect confidentiality.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Target | Skill | Description |
|---|---|---|
| **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share |
| **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi |
| **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Target | Skill | Description |
|---|---|---|
| **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share |
| **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi |
| **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup |

All targets use AES-256-GCM encryption. Your backup destination only sees opaque `.enc` chunk files — no file names, no metadata, no structure.

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

|---|---|---|
| **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share |
| **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi |
| **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup |

All targets use AES-256-GCM encryption. Your backup destination only sees opaque `.enc` chunk files — no file names, no metadata, no structure.

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The restore workflow is documented without a clear warning that restoring backups or snapshots can overwrite existing local workspace contents. In an agent or automation context, users may run these commands non-interactively and unintentionally replace current data, causing data loss or rollback to stale state.

Static analysis

No suspicious patterns detected.