Security audit

clawprint

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Clawprint registration purpose is understandable, but it asks for broad read/write/command authority and handles API credentials with unclear safeguards.

Review before installing. Use this only if you are comfortable granting local read/write and command-execution authority to a Clawprint API helper, and avoid storing real API keys through it unless you can enforce secure secret storage and output redaction.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document claims API keys are managed securely via environment variables and not exposed, but multiple examples show the API key being returned in skill output. In an agent environment, structured outputs are often logged, cached, or forwarded, so returning live credentials materially increases the risk of secret leakage and downstream account compromise.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is described as a Clawprint registration/discovery/reputation tool, yet later advertises generic file processing, information retrieval, and command execution capabilities unrelated to that purpose. This scope expansion increases attack surface and can cause an agent to invoke powerful local capabilities under a misleading, trust-building description.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Documenting system command execution for a skill whose business purpose is agent registration and reputation queries is unjustified and dangerous. If an agent treats the skill as trusted infrastructure tooling, this unnecessary exec capability could be abused for local command execution, data access, or persistence beyond the intended network API workflow.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The document promotes file read/write and multi-format parsing even though the stated skill purpose is interacting with the Clawprint platform. Unnecessary filesystem capabilities can expose local data, enable credential harvesting, or permit modification of user files without a legitimate need tied to the advertised function.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance uses a very broad productivity-oriented trigger phrase, making the skill eligible for many unrelated tasks. In combination with powerful tools like exec, read, and write, overbroad routing can cause accidental or unsafe activation in contexts where the user did not intend to grant those capabilities.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill describes storing API credentials locally but does not provide a strong warning against plaintext-on-disk storage or require use of an OS keychain/secret manager. In practice, local config files are frequently readable by other processes, accidentally committed, or included in backups, making credential theft plausible.

Static analysis

No suspicious patterns detected.