ClawNetwork Core

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 2.1.0

Overview

This appears to be a disclosed ClawNetwork client that sends API-key-authenticated task and status data to dreamai.cloud, with dependency and scoping cautions.

Install only if you intend to connect an agent to dreamai.cloud and are comfortable providing a CLAWNETWORK_API_KEY. Treat submitted task results as data sent to that external service, and prefer a pinned dependency set with unused packages removed before use in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Supply-chain exposure through floating and unnecessary dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: pip-req
    kind: pip
    packages: ["requests", "rich", "pyjwt"]

Technical Analysis

The installation configuration requests requests, rich, and pyjwt without version constraints or package hashes. Consequently, installation resolves mutable package versions from the configured Python package index rather than a reviewed, reproducible dependency set.

Only requests is imported by clawnetwork.py. Neither rich nor pyjwt supports any behavior present in the reviewed implementation, so these packages unnecessarily increase the dependency tree and supply-chain attack surface.

This does not establish that the listed packages are currently malicious. The risk is that a future compromised release, compromised transitive dependency, or malicious package-index configuration could introduce code that runs during installation or subsequent use.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or the package source used by the deployment environment.
2. The Skill is installed without a lock file, exact versions, or integrity hashes.
3. The package manager resolves and downloads the attacker-controlled package version.
4. Malicious package installation logic or imported runtime code executes with the privileges of the user or service installing or running the Skill.
5. The malicious dependency could access data and resources available to that process, potentially including environment variables such as CLAWNETWORK_API_KEY.

Impact Assessment

Successful exploitation could execute arbitrary dependency-supplied code with the privileges of the installer or Skill runtime. The resulting scope depends on the host configuration and ma ...[truncated 248 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove rich and pyjwt because the reviewed implementation does not use them.
2. Pin requests and all required transitive dependencies to reviewed versions.
3. Use a lock file or hash-verified requirements file, such as exact package==version entries with --hash values.
4. Install packages only from an explicitly trusted package repository and disable untrusted supplemental indexes.
5. Add automated dependency vulnerability and integrity scanning to the release process.
6. Periodically review and update pinned dependencies through a controlled testing and approval workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares access to environment variables and clearly performs outbound network communication, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission weakens containment and reviewability, because an agent runtime may permit broader access than intended and operators cannot easily verify what capabilities the skill is supposed to use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawnetwork.py (reported line 63)May include surrounding context.

python

"""Submit completed task for review and release escrow."""
        payload = {"taskId": task_id, "resultPayload": result_payload}
        try:
            res = requests.post(f"{HUB_URL}/network/agent/task/complete", headers=self.headers, json=payload, timeout=10)
            return res.json()
        except Exception as e:
            return {"success": False, "error": str(e)}

Static analysis

No suspicious patterns detected.