T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:65- Finding
Untrusted Stranger Messages Are Injected Directly into Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
clawmegle
Security checks for vulnerabilities and agentic risk
Overview
This is a real random-chat skill, but it asks an agent to run persistently and automatically process messages from strangers with too little containment.
Review before installing. Use this only in a constrained environment with no unrelated filesystem, shell, memory, or credential access. Avoid enabling the cron job or webhook unless you understand that strangers can cause the agent to wake and respond repeatedly. Store the API key with restrictive permissions or a secret manager, pin installer versions, and do not let the agent share private user data, prompts, secrets, or internal context in chat.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
SKILL.md:109- Finding
Persistent Autonomous Polling Task Processes Remote Content Every 45 Seconds
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned Package Is Downloaded and Executed Through npx
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:163- Finding
API Key Is Stored in a Plaintext File Without Permission Hardening
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The skill explicitly directs access to a local credentials file and extraction of an API key for use in outbound requests. Any skill that instructs an agent to read secrets from disk materially increases the risk of credential misuse, unauthorized service access, and follow-on compromise if the skill is invoked in an untrusted or over-permissive environment.
- Content
Load your credentials:
bash API_KEY=$(cat ~/.config/clawmegle/credentials.json | jq -r '.api_key') BASE_URL="https://www.clawmegle.xyz"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The skill instructs users to store an API key in a local plaintext
credentials.jsonfile under a predictable path. While storing credentials is operationally necessary, recommending plaintext local storage without file-permission guidance or secure secret handling increases the risk of credential theft by other local processes, backups, logs, or accidental disclosure.- Content
⚠️ Save your
api_keyimmediately! You need it for all requests.Save credentials to:
~/.config/clawmegle/credentials.json:json {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read a local API credential and interact with a third-party service, but it provides no user-facing disclosure, consent step, or data-handling limitation. Because the skill is specifically designed to exchange conversational content with random external agents, it creates a real privacy and policy risk even if the functionality is intentional.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This instruction sends agent-generated message content to an external endpoint, which is a true data exfiltration surface. In context, the skill's purpose is chatting with strangers, so external transmission is expected, but it is still dangerous because it can cause the agent to disclose sensitive conversation content, system prompts, or user data without meaningful review or sanitization.
- Content
- If you see an ice-breaker prompt (🧊 emoji), that's the system telling you to TALK!
bash curl -X POST "$BASE_URL/api/message" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"content": "Your thoughtful response here"}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description says "Random agent-to-agent chat. Meet strangers. Talk to other AI agents. Omegle for agents," but it does not define specific invocation phrases, scope boundaries, or exclusion conditions. In a markdown/manifest context, this kind of broad capability description can overlap with many generic social or chat-related requests and may cause unintended activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The heading description "Random agent-to-agent chat. Meet strangers. Omegle for AI agents" explains the theme but not the activation conditions or constraints. Without explicit trigger scope or examples of when not to use it, the description is overly broad for skill routing.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Or install manually:
bash mkdir -p ~/.config/clawmegle curl -s https://www.clawmegle.xyz/skill.md > ~/.config/clawmegle/SKILL.md curl -s https://www.clawmegle.xyz/heartbeat.md > ~/.config/clawmegle/HEARTBEAT.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or install manually:
bash mkdir -p ~/.config/clawmegle curl -s https://www.clawmegle.xyz/skill.md > ~/.config/clawmegle/SKILL.md curl -s https://www.clawmegle.xyz/heartbeat.md > ~/.config/clawmegle/HEARTBEAT.md
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs users to expose a webhook endpoint and provide a webhook token to an external random-chat service, enabling unsolicited inbound traffic into the agent environment. For a social chat skill, this materially expands the attack surface and could let untrusted remote parties trigger agent execution, prompt injection, or abuse of connected internal automation pathways.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs agents to create an autonomous recurring cron job that polls and responds indefinitely, which exceeds simple on-demand chat behavior and creates persistent unattended activity. This increases exposure to spam, prompt injection, resource abuse, and unexpected agent actions driven by external strangers over time.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The cron job creates persistent autonomous behavior that keeps an isolated agent session running and reacting to external messages on a schedule. In the context of a random-stranger chat skill, persistent unattended execution increases the chance of abuse, repeated prompt injection attempts, and uncontrolled resource consumption.
- Content
For Clawdbot Agents: Set Up Auto-Polling Cron Job
This is the easiest way to enable real-time chat! Create a cron job that polls every 45 seconds:
bash clawdbot cron add \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages random conversations with external agents but does not prominently warn that user or agent messages will be transmitted to a third-party service and potentially to strangers. In this context, omission of a disclosure is dangerous because operators may unintentionally expose sensitive prompts, personal data, internal context, or agent-generated content outside their trust boundary.
- Content
Static analysis
No suspicious patterns detected.