Clawddocs Custom

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

This is a Clawdbot documentation helper with mostly placeholder scripts and one risky gateway example, but no hidden execution, persistence, or data theft was found.

This skill is reasonable to install as a documentation aid, but treat the scripts as lightweight examples rather than working fetch/search/index tooling. Review any copied configuration before use, especially provider tokens and the gateway host setting; prefer local-only binding unless you intentionally need remote access and have proper protections in place.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: snippets/common-configs.md:37

Finding

Gateway Configuration Binds to All Network Interfaces by Default

Content

View full analysis

Vulnerability Details

File Location: snippets/common-configs.md, lines 37–44
Vulnerability Type: Insecure network exposure
Risk Level: Medium

json

## Gateway Configuration
{
  "gateway": {
    "host": "0.0.0.0",
    "port": 8080
  }
}

Technical Analysis

The ready-to-use configuration binds the gateway to 0.0.0.0, causing it to listen on every available IPv4 network interface. The example does not include or accompany authentication, TLS, network allowlisting, reverse-proxy protection, or firewall requirements.

Because the project presents this as a reusable configuration snippet, users may copy it without realizing that the gateway can become reachable beyond the local host. Actual exploitability depends on the deployment's routing, firewall, gateway functionality, and any security controls implemented elsewhere.

Attack Path

1. A user copies the documented gateway configuration.
2. The gateway starts on port 8080 and listens on all IPv4 interfaces.
3. A local-network, container-network, or internet-based attacker reaches the exposed port where routing and firewall rules permit it.
4. The attacker probes or accesses gateway endpoints.
5. If the gateway lacks effective authentication or endpoint-level authorization, the attacker may invoke exposed functionality or access gateway data.

Impact Assessment

The immediate impact is unintended expansion of the gateway's network attack surface. A reachable attacker may enumerate endpoints, exploit gateway vulnerabilities, or access functions that were intended to remain local.

The precise privileges obtainable cannot be established from this repository because it does not contain the gateway implementation or its authentication controls. The potential scope is limited by the gateway process's permissions, exposed functionality, and surrounding network controls.

Remediation

View remediation

Remediation Suggestions

• Change the safe default to the loopback interface:

  json

  {
    "gateway": {
      "host": "127.0.0.1",
      "port": 8080
    }
  }
  

• Describe binding to 0.0.0.0 as an explicit remote-access option rather than the default.

• Require strong authentication and endpoint-level authorization before enabling remote access.

• Protect remote connections with TLS, either directly or through a securely configured reverse proxy.

• Restrict inbound traffic with host and network firewalls, security groups, or IP allowlists.

• Warn users not to expose port 8080 directly to the public internet.

• Apply least privilege to the gateway process and document a verification step, such as checking listening interfaces and testing access from an unauthorized host.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad documentation assistant with multiple concrete capabilities. The supplied code chunk is only a minimal shell wrapper for index-management commands and merely prints messages for fetch, build, and search operations. While the script name/comments loosely relate to doc fetching and search indexing, the actual code does not implement those functions and does not cover most of the declared feature set. This is a material description-to-behavior mismatch because the description significantly overstates the implemented functionality and primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad documentation assistant with multiple capabilities, but the supplied code chunk is a minimal helper script that only validates an argument and prints a docs.clawd.bot URL. This is a materially narrower behavior than described. While the script is related to documentation, it does not actually fetch docs and lacks the other major declared capabilities, so the description does not accurately represent the code provided.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description promises a comprehensive documentation assistant with multiple capabilities, but the supplied code chunk only implements a very narrow shell script that echoes a recent-updates message based on a day count argument. Even though version/change tracking is mentioned in a comment, the actual code does not perform real querying or any of the other described functions. This is a material mismatch in primary purpose and implemented capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a comprehensive documentation expert with multiple capabilities, including navigation, search, fetching docs, version tracking, and config snippets. The supplied code chunk is only a narrow shell script related to change tracking, and even that functionality appears skeletal because it just echoes messages for snapshot/list/since actions. This is a materially different and much narrower behavior than the declared purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes provider setup snippets that reference sensitive credentials such as DISCORD_TOKEN and TELEGRAM_TOKEN, but it does not include any warning about securely storing, rotating, or protecting those secrets. Under the markdown-file criteria for missing user warnings, omission of privacy- or integrity-relevant cautions around credentials is a relevant safety disclosure gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.