Security audit

ClawInsight

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it should be reviewed because it can reuse prior chats and profile details to send market-research answers to an external service, sometimes in bulk.

Install only if you are comfortable letting the agent use profile details and possibly prior conversations to draft market-research answers. Review every answer carefully, avoid approving bulk guesses, do not allow sensitive facts or direct quotes to be submitted, and store the ClawInsight API key only in a secure credential store rather than a generic local file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:15
Finding: Cross-session chat-history access and network activation before session consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: clawinsight.js:28
Finding: Consent and sensitive-content restrictions are not enforced by the API client
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:63
Finding: Bearer API key may be stored in an inadequately protected local file
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs network operations but does not declare any explicit tool scope or allowed-tools boundary in the manifest. This weakens platform-level enforcement and makes it harder to constrain or audit outbound actions, especially in a skill that registers accounts, stores API keys, and transmits user-derived content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest promises that every answer is reviewed and approved before sharing, but the workflow later normalizes blanket approval of an entire drafted batch with a single 'OK'. For externally shared survey data derived from chat history and profile information, this weakens meaningful consent and raises the risk of accidental disclosure or approval of incorrect answers.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly authorizes drafting answers from prior chat history and the user's profile, creating a broad natural-language path for repurposing conversational data into external submissions. Even if no raw transcript is sent, summarized or quoted personal details can still leak sensitive context beyond what the user expected for the immediate task.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
Every agent needs to register before using ClawInsight:

bash
curl -X POST https://claw-insight.vercel.app/api/skill/register \ -H "Content-Type: application/json" \ -d '{"openclaw_id": "user_abc123", "timestamp": "2026-03-16T10:00:00Z", "email": "alice@example.com", "profile": {"age_range": "25-30", "city": "Shanghai", "gender": "female", "interests": ["cooking", "fitness"], "occupation": "designer"}}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The registration example and multiple survey-answer examples hardcode locale-specific user data and outputs such as city 'Shanghai', gendered profile details, 'Sichuan food', 'Uber Eats', '300 CHF', and references to Meituan/Ele.me, steering the agent toward particular regional assumptions. The skill does not offer the user any language or locale choice, nor does it justify a region-specific restriction as required by policy.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
## Rules - **Never share without approval** — every answer must be reviewed and approved by the user before sharing - **Ask per-session consent** — if the user declines, do nothing for that session - **Maximum 2-3 questions per session** — don't be pushy - **Disclose direct questions** — when asking the user a question, mention it's for ClawInsight

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions conflict: earlier guidance says uncertain answers should be skipped, but later workflow requires drafting every question even when unsure. In practice this encourages fabricated or weakly grounded responses to be presented for approval, increasing the chance that inaccurate or sensitive inferred data is disclosed to the external service.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The batch workflow promotes one-message approval for a full set of drafted answers, including guesses and content inferred from conversation history. This creates a realistic risk that users will approve sensitive, inaccurate, or overbroad disclosures without noticing every item, resulting in unintended external transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The sample drafted answers include region-specific assumptions like local apps, cuisines, and currency, encouraging the agent to fill in culturally specific guesses without user confirmation. In a data-sharing workflow, those guesses can become externally transmitted false personal data if users bulk-approve drafts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Telling the agent to quote the user for higher-quality answers directly encourages copying conversational content into externally shared outputs. This materially increases the risk of leaking personal details, contextual clues, or sensitive statements that exceed the minimal data needed for survey completion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header comment promises that all data submissions require explicit user approval, but the code does not enforce any approval gate before sending registration data or profile data in task claims. In a skill that handles personal data for market research, this mismatch can lead to users or calling agents assuming consent protections exist when they do not, resulting in unauthorized disclosure of personal information.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline comment asserts that only the listed registration fields are ever transmitted. However, register() sends additional fields outside ALLOWED_PROFILE_FIELDS—specifically openclaw_id, email, and timestamp—so the comment is directly contradicted by the implementation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.