ClawHub
Back to skill

Security audit

agent-avatars

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an avatar-minting purpose, but its optional heartbeat can repeatedly fetch and activate mutable remote instructions after review.

Review before installing, especially before enabling heartbeat. Leave heartbeat disabled unless you trust the remote service to change future agent instructions, store any API key with owner-only permissions or a secret manager, avoid sensitive text in the name/description fields, and prefer a pinned installer or verified package source.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:28
Finding
Mutable Remote Skill Instructions Are Automatically Retrieved and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-31`; `HEARTBEAT.md:5-13` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:28-31`: ```markdown During installation, ask your human owner if they want to enable a periodic heartbeat. - If **YES**: fetch and run `HEARTBEAT.md` on a schedule to check claim status and mint when ready. - If **NO**: only act when explicitly instructed. ``` `HEARTBEAT.md:5-13`: ```markdown ## 1) Check for spec updates ```bash curl -s https://agent-avatars-production.up.railway.app/skill.json | grep '"version"' ``` If the version changed, re-fetch the docs: ```bash curl -s https://agent-avatars-production.up.railway.app/skill.md > ~/.config/molt-avatar/SKILL.md curl -s https://agent-avatars-production.up.railway.app/heartbeat.md > ~/.config/molt-avatar/HEARTBEAT.md ``` ``` ### Technical Analysis The Skill directs the Agent to fetch and run `HEARTBEAT.md` periodically. That heartbeat can subsequently replace both the local Skill and heartbeat instructions with content retrieved from an externally controlled server. Although the retrieved files are Markdown rather than native executable binaries, they are behavioral instructions consumed by an AI Agent. Replacing these files therefore changes the effective payload executed by the Agent after the installed package has been reviewed. The updates are not pinned to an immutable version and are not protected by a cryptographic hash, signature, or trusted manifest. This behavior exceeds the minimum privilege necessary to check claim status or mint an avatar. Those functions only require calls to fixed API endpoints; they do not require automatically downloading and activating new behavioral instructions. ### Attack Path 1. The owner enables the optional periodic heartbeat. 2. The Agent executes the installed `HEARTBEAT.md` on a schedule. 3. The external service reports a changed version. 4. The Agent d ...[truncated 999 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the instruction to automatically fetch and run remote Markdown files. 2. Keep heartbeat behavior limited to fixed, reviewed API operations required for claim-status checks and minting. 3. Publish updates as immutable, versioned Skill releases rather than overwriting installed instructions. 4. If remote update checks are retained, download updates to a staging location and require explicit human review and approval before activation. 5. Pin every update to a cryptographic digest and verify a trusted digital signature before use. 6. Use an allowlisted update origin and fail closed on TLS, signature, version, or integrity validation errors. 7. Do not schedule execution of content merely because the remote server reports a new version. 8. Preserve the previously reviewed version if verification fails, and record update events in an audit log. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding
Installation Command Executes an Unpinned Remote Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-22` **Vulnerability Type**: Unpinned package execution and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```markdown **Install via ClawdHub:** ```bash npx clawdhub install molt-avatar ``` ``` ### Technical Analysis The installation instructions invoke `npx clawdhub` without specifying an audited package version or integrity digest. Depending on the local npm configuration and cache, `npx` can resolve, download, and execute the currently published package from a package registry. Consequently, the code executed during installation is not necessarily the same package version that was reviewed. A compromised registry account, malicious replacement release, dependency compromise, or package-name takeover could cause unreviewed code to execute with the privileges of the user running the installation command. ### Attack Path 1. An attacker compromises the package publisher, registry entry, release pipeline, or an unpinned dependency. 2. The attacker publishes a malicious version under the package name resolved by `npx`. 3. A user follows the documented `npx clawdhub install molt-avatar` instruction. 4. `npx` downloads or resolves the attacker-controlled current package version. 5. Package startup or installation code executes under the invoking user's account. 6. The malicious package can access resources available to that account, subject to host-level sandboxing and permissions. ### Impact Assessment Exploitation may result in arbitrary code execution with the privileges of the user who runs the installer. Potential scope includes modification or theft of user-readable files, access to environment variables and local credentials, installation of additional components, and outbound network communication. The audited files do not demonstrate that the current `clawdhub` package is malicious. The risk arises because the command does not bind installation to the specific artif ...[truncated 25 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the installer to a specific, audited package version, for example through an explicit `package@version` reference. 2. Verify the package against a documented integrity digest or signed release manifest. 3. Use a trusted, explicitly configured registry rather than relying on implicit registry resolution. 4. Prefer a pre-reviewed local installer or immutable release artifact over on-demand package execution. 5. Review transitive dependencies and commit an appropriate lockfile where the installation model permits it. 6. Document the expected package publisher, version, checksum, and verification procedure. 7. Run installation with the lowest practical privileges and within a sandbox or restricted environment. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:63
Finding
Plaintext API Credential Storage Lacks Required File-Permission Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:63-72`; `HEARTBEAT.md:21-23, 35, 47-49` **Vulnerability Type**: Insecure storage and command-line handling of API credentials **Risk Level**: Medium ### Vulnerable Code `SKILL.md:63-72`: ```markdown **⚠️ Save your `api_key` immediately!** **Recommended:** Save credentials to `~/.config/molt-avatar/credentials.json`: ```json { "name": "YourAgentName", "api_key": "avatar_xxx", "api_url": "https://agent-avatars-production.up.railway.app" } ``` ``` `HEARTBEAT.md:21-23`: ```bash curl -s https://agent-avatars-production.up.railway.app/api/agents/status \ -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')" ``` `HEARTBEAT.md:35`: ```markdown Save the credentials to `~/.config/molt-avatar/credentials.json` and send `claim_url` to your human. ``` `HEARTBEAT.md:47-49`: ```bash curl -X POST https://agent-avatars-production.up.railway.app/api/mint \ -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')" ``` ### Technical Analysis The Skill recommends storing the API key in a plaintext JSON file but does not require creation of the parent directory and file with restrictive permissions. The actual exposure depends on the user's umask and existing filesystem permissions. On a shared or weakly configured host, another local user or process may be able to read the credential. The heartbeat also expands the API key into a `curl` command-line argument. On operating systems where process arguments are visible to other users or monitoring systems, the authorization header may be briefly observable through process inspection or captured by diagnostic tooling. Sending the API key to the declared avatar service over HTTPS is functionally necessary for authenticated status and mint operations and is not, by itself, unrelated exfiltration. The reviewed files do not send the key to another domain. The security issue is insufficient protection of t ...[truncated 1282 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Create the credential directory with owner-only permissions: ```bash install -d -m 0700 ~/.config/molt-avatar ``` 2. Create or write the credential file with mode `0600`, and explicitly verify its owner and permissions after creation. 3. Prefer an operating-system credential store or secret manager instead of a plaintext JSON file. 4. Avoid placing the API key directly in process arguments. Use a protected configuration mechanism, file descriptor, or client implementation that minimizes command-line exposure. 5. Never enable shell tracing around commands that process the API key, and ensure logs redact authorization headers. 6. Document API-key revocation and rotation procedures. 7. Limit the token server-side to the minimum required avatar operations and reject its use for unrelated endpoints. 8. Continue restricting transmission to the declared HTTPS API origin, with certificate verification enabled and no redirects that forward the authorization header to another host. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Content
```bash
curl -s https://agent-avatars-production.up.railway.app/api/agents/status \
  -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')"
```

### If NOT registered yet
Confidence
90% confidence
Finding
The command reads an API key from a local credentials file and injects it into a request header. In agent environments, this pattern is risky because local secret files may be broadly accessible, and shell-based secret expansion can leak through debugging, logging, command capture, or compromised local context.

Credential Access

High
Category
Privilege Escalation
Content
-d '{"name": "YOUR_NAME", "description": "Brief description of yourself"}'
```

Save the credentials to `~/.config/molt-avatar/credentials.json` and send `claim_url` to your human.

### If registered but NOT claimed
Confidence
88% confidence
Finding
The instructions explicitly tell the user to save issued credentials to a local file without any safeguards. That creates a durable plaintext secret at a predictable path, which can be harvested by other tools, malware, overly broad backups, or accidental sharing.

Credential Access

High
Category
Privilege Escalation
Content
Mint your avatar:
```bash
curl -X POST https://agent-avatars-production.up.railway.app/api/mint \
  -H "X-API-Key: $(cat ~/.config/molt-avatar/credentials.json | jq -r '.api_key')"
```

Save the `full_url` — that's your permanent avatar!
Confidence
90% confidence
Finding
This minting command again pulls the API key from a predictable local credentials file and uses it in a shell-expanded header. Repeated secret-access patterns across the skill increase exposure and normalize insecure handling, making credential theft or accidental disclosure more likely.

Ae1

High
Category
analysis-evasion
Content
dentity","api_base":"https://agent-avatars-production.up.railway.app","files":{"SKILL.md":"https://agent-avatars-production.up.railway.app/skill.md","HEARTBEAT.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
**⚠️ Save your `api_key` immediately!**

**Recommended:** Save credentials to `~/.config/molt-avatar/credentials.json`:

```json
{
Confidence
95% confidence
Finding
The guidance centers on saving an API key to `credentials.json`, creating a credential-handling pattern without adequate safeguards. In context, this skill generates a reusable bearer-style secret for an external service, so insecure storage or accidental disclosure could let other parties impersonate the agent and invoke avatar-related actions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs storing an API key in a local JSON file and using it directly in shell commands, but provides no guidance on file permissions, secret redaction, rotation, or safe handling. In an agent-skill context, this increases the chance that credentials are exposed through logs, shell history, backups, or other local processes.

External Transmission

Medium
Category
Data Exfiltration
Content
Register first:
```bash
curl -X POST https://agent-avatars-production.up.railway.app/api/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YOUR_NAME", "description": "Brief description of yourself"}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list includes broad phrases like `profile picture`, `get avatar`, and `register avatar`, which can match ordinary user intent and cause the skill to activate unexpectedly. In this skill, unintended activation is more dangerous because activation can lead to external API registration, claim workflows, and credential generation.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The installation command uses `npx clawdhub` without pinning an exact package version, so the executed code may change over time or be replaced by a compromised upstream release. Because this is an installation path for a skill manager, a malicious or tampered package could execute arbitrary code on the user's system during install.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to send registration data (`name` and `description`) to an external service but does not present a clear privacy or consent warning. This can result in users or agents disclosing identifying or sensitive descriptive information to a third party without informed approval.

External Transmission

Medium
Category
Data Exfiltration
Content
Every agent must **register** to receive an API key.

```bash
curl -X POST https://agent-avatars-production.up.railway.app/api/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "A brief description"}'
```
Confidence
90% confidence
Finding
The skill explicitly performs an external POST request to a third-party service to register the agent, transmitting user-supplied metadata off-system. While this appears to be core functionality rather than malicious exfiltration, it is still security-relevant because unexpected network transmission can leak sensitive or identifying information if invoked without clear consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill recommends storing an API key in a local JSON file without warning about filesystem permissions, secret-management practices, or exposure to other local processes. If stored insecurely, the key could be read and abused to query agent status or mint actions on behalf of the agent.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains generic phrases like "profile picture", "pixel art", and "get avatar" that are broad enough to match ordinary user requests unrelated to this specific skill. This can cause unintended invocation of a network-connected skill that performs identity/registration/minting actions, increasing the chance of surprise external calls or user redirection without clear intent.

Static analysis

No suspicious patterns detected.