T08 · Insecure Dependencies
Warning
- Location
SKILL.md:11- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawkeep
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent backup tool, but it asks users to install an unaudited global CLI, run persistent backup services, and handle cloud credentials in ways that need careful review.
Install only if you trust the `clawkeep` npm package and understand it will read, snapshot, restore, and potentially sync broad workspace contents. Pin and verify the CLI version where possible, use least-privilege S3/API keys, avoid putting real secrets directly on command lines, test restore into a separate directory first, and stop/remove any watch, UI, or PM2 daemon when it is no longer needed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
s3/SKILL.md:20- Finding
S3 and Cloud Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
s3/SKILL.md:145- Finding
Plaintext HTTP MinIO Endpoint Documented Alongside Storage Credentials
- Content
View full analysis
\ --secret-key \ --region us-east-1 \ -d /path/to/workspace ``` ``` ### Technical Analysis The MinIO example uses an unencrypted `http://` endpoint while also supplying access and secret keys. Although the example specifically uses `localhost`, users may copy the configuration and replace `localhost` with a remote hostname or private-network address without enabling TLS. S3 request-signing mechanisms do not provide the confidentiality and full transport protection supplied by TLS. An attacker with a suitable network position may observe request details, collect authentication material useful for replay or offline analysis, interfere with responses, or manipulate traffic. Client-side encryption of backup chunks does not secure storage credentials or all protocol metadata in transit. The documentation does not clearly restrict this HTTP example to loopback-only development use, require HTTPS for remote MinIO servers, or state that certificate validation must remain enabled. ### Attack Path 1. A user copies the documented MinIO example. 2. The user replaces `localhost` with a remote MinIO server or exposes the local service over a shared network while retaining `http://`. 3. Backup operations transmit S3-compatible requests over a plaintext connection. 4. An attacker positioned on the same network, gateway, proxy, or routing path observes or modifies the traffic. 5. The attacker attempts to replay captured requests, interfere with backup operations, redirect traffic, or leverage exposed information to access the object store. 6. If storage access is obtained, the attack ...[truncated 834 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Prerequisites 1. ClawKeep CLI installed (`npm install -g clawkeep`) 2. An S3-compatible bucket with access credentials ## Quick Setup
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs users to run initialization and a background watch daemon that continuously modifies the target workspace by creating backup metadata, commits, and synchronizing ignore files, but it does not prominently warn that these are persistent write operations. In a backup/versioning skill, this omission is risky because users may apply it to sensitive or already-managed repositories and unintentionally alter workspace state, history, or ignore behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The dashboard command starts a local service that exposes workspace history and file contents through a browser-accessible interface, yet the skill does not clearly warn about the trust boundary or local exposure. Even with token-based auth, users should be told that a listening service is being launched and that binding, port exposure, and token handling affect confidentiality.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | Target | Skill | Description | |---|---|---| | **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share | | **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi | | **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup |
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | Target | Skill | Description | |---|---|---| | **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share | | **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi | | **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup | All targets use AES-256-GCM encryption. Your backup destination only sees opaque `.enc` chunk files — no file names, no metadata, no structure.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md |---|---|---| | **Local path** | [skills/local/SKILL.md](local/SKILL.md) | NAS, USB drive, external disk, network share | | **S3 / R2** | [skills/s3/SKILL.md](s3/SKILL.md) | Cloudflare R2, AWS S3, Backblaze B2, MinIO, Wasabi | | **ClawKeep Cloud** | [skills/clawkeep-cloud/SKILL.md](clawkeep-cloud/SKILL.md) | Managed zero-knowledge backup with browser-based setup | All targets use AES-256-GCM encryption. Your backup destination only sees opaque `.enc` chunk files — no file names, no metadata, no structure.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The restore workflow is documented without a clear warning that restoring backups or snapshots can overwrite existing local workspace contents. In an agent or automation context, users may run these commands non-interactively and unintentionally replace current data, causing data loss or rollback to stale state.
- Content
Static analysis
No suspicious patterns detected.