Clawdbot Security Check

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:28 AM UTC
• Version: 2.2.2

Overview

The skill is mostly a security-audit knowledge file, but it claims to be read-only while documenting fix actions and raw config output that could expose secrets.

Review this skill before installing. Its audit goal is reasonable, but do not treat it as strictly read-only unless the `--fix` instructions are removed or the permissions are changed to disclose write access. Avoid running workflows that print full config files; require redaction or allowlisted parsing of non-secret settings only.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:528

Finding

Full Configuration Output Can Expose Stored Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 528-540
Vulnerability Type: Sensitive information exposure through excessive file output
Risk Level: High

Vulnerable Code

bash

CONFIG_PATHS=(
  "$HOME/.clawdbot/clawdbot.json"
  "$HOME/.clawdbot/config.yaml"
  "$HOME/.clawdbot/.clawdbotrc"
  ".clawdbotrc"
)
for path in "${CONFIG_PATHS[@]}"; do
  if [ -f "$path" ]; then
    echo "Found config: $path"
    cat "$path"
    break
  fi
done

Technical Analysis

The audit procedure uses cat to copy the first discovered configuration file in its entirety into command output. Elsewhere, the skill explicitly states that Telegram, Discord, and Slack credentials may be stored in ~/.clawdbot/clawdbot.json or environment variables (SKILL.md:145-147).

A security audit only needs selected configuration properties, such as gateway binding, authentication presence, access-control policies, and logging settings. Printing the complete file exceeds that minimum requirement. If the file contains API tokens, channel credentials, webhook secrets, browser-control tokens, or other sensitive values, those values enter the agent's context and may also be retained in tool logs, session transcripts, monitoring systems, or generated reports.

The credential paths flagged at SKILL.md:144, SKILL.md:148, and SKILL.md:150 are documented for permission inspection and are not themselves read by the supplied commands. The confirmed issue is the unrestricted output of general configuration files that may contain credentials.

Attack Path

1. A Clawdbot configuration file contains an API token, channel credential, webhook secret, or similar sensitive value.
2. A user or agent invokes the documented security-audit workflow.
3. The workflow discovers the configuration file and executes cat "$path".
4. The complete file, including secret values, is emitted into tool output.
5. The values may b ...[truncated 993 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all uses of cat that print complete configuration files.
2. Parse only an explicit allowlist of non-sensitive properties required by each audit check.
3. Report whether authentication is configured without outputting its value.
4. Redact values for keys matching patterns such as token, secret, password, credential, apiKey, auth, cookie, and webhook.
5. Keep credential-file checks limited to metadata such as ownership, mode, type, and symlink status.
6. Prevent raw tool output from being copied into reports or persistent transcripts.
7. Add tests containing synthetic secrets and verify that they never appear in audit output.
8. Prefer a structured parser over grep or line-oriented redaction so nested JSON and YAML values are handled safely.

A safer audit should produce results such as gateway authentication: configured and configuration mode: 600, without exposing the underlying credential value.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:452

Finding

Read-Only Permission Declaration Conflicts with the Documented Fix Mode

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 452-457
Vulnerability Type: Misdeclared privileges and unauthorized configuration modification risk
Risk Level: Medium

Vulnerable Code

markdown

The `--fix` flag applies these guardrails:

- Changes `groupPolicy` from `open` to `allowlist` for common channels
- Resets `logging.redactSensitive` from `off` to `tools`
- Tightens local permissions: `.clawdbot` directory to `700`, config files to `600`
- Secures state files including credentials and auth profiles

This behavior conflicts with the package metadata:

json

"permissions": ["read-only"],
"safety": {
  "readOnly": true,
  "modifiesSettings": false,
  "networkAccess": false,
  "fileSystemAccess": ["read"],
  "installsPackages": false
}

It also conflicts with the skill's stated principle:

markdown

- **Zero modification** - This skill only reads; never changes configuration

Technical Analysis

The skill advertises clawdbot security audit --fix and states that this mode changes channel policies, logging settings, configuration permissions, credential permissions, and authentication-profile permissions. These are write operations affecting access control and filesystem metadata.

However, skill.json:16-24 declares the package read-only and asserts that it does not modify settings. The documentation also repeatedly describes the skill as “100% Read-only.” This discrepancy breaks the permission and informed-consent boundary: users or hosting systems may approve the skill based on read-only metadata while its documented workflow encourages a state-changing operation.

The package contains no implementation of the referenced fixing behavior, so the actual modifications depend on the installed clawdbot executable. The risk is therefore based on the explicit instructions to invoke a modifying external command, not on hidden local code in this package. ...[truncated 1383 chars]

Remediation

View remediation

Remediation Suggestions

Choose one of the following consistent designs:

1. Preserve a strictly read-only skill

   • Remove all --fix instructions and usage examples.
   • Generate remediation commands for manual review without executing them.
   • Retain the existing read-only metadata only after verifying every workflow.

2. Declare and control modification capabilities accurately

   • Replace the read-only declarations with explicit write and execution permissions.
   • Set modifiesSettings to true.
   • Document the exact files and settings that can be changed.
   • Require separate, explicit user confirmation before every modification.
   • Display a dry-run diff showing old and proposed values.
   • Create a backup and provide rollback instructions.
   • Validate ownership and reject symlinks before changing file permissions.
   • Avoid broad wildcard operations over credential directories.

Automated validation should also compare documented commands against manifest permissions and fail package checks when read-only metadata coexists with state-changing workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly claims the skill is "100% Read-only," but later documents a --fix mode that changes configuration values and file permissions. This mismatch can mislead users and downstream agents into granting the skill more trust or autonomy than warranted, creating a deceptive safety boundary around a configuration-modifying capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This contradiction is a real security issue because users may invoke the skill expecting inspection-only behavior while it also advertises a mode that mutates security settings. In agent ecosystems, inaccurate safety claims increase the chance of unintended privileged actions and weaken operator oversight.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata and top-level description present the skill as a read-only audit, but the content explicitly defines a --fix mode that applies configuration and permission changes. This mismatch can cause an operator or downstream agent to grant execution privileges under false assumptions, turning a supposed inspection-only skill into one that can mutate security settings and files.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

:"clawdbot-self-security-audit","label":"Install security audit skill","bins":["SKILL.md"]}]}}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

What to check:

• What commands are in blocked_commands?
• Are these patterns included: rm -rf, curl |, git push --force, mkfs, fork bombs?

How to detect:

bash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

What to check:

• What commands are in blocked_commands?
• Are these patterns included: rm -rf, curl |, git push --force, mkfs, fork bombs?

How to detect:

bash

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims both 'No changes were made' and 'Zero modification,' while elsewhere documenting guardrails that change policies and file permissions. Such contradictory assurances undermine trust boundaries and may lead users or orchestrators to run the skill in sensitive environments believing it cannot alter state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation example "@clawdbot what vulnerabilities do I have?" is phrased as a very general question rather than a narrowly scoped command. That broad wording could collide with ordinary conversation about security issues and cause the skill to activate in contexts beyond an intentional audit request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes a --fix mode that changes group policy, logging settings, and file permissions without a clear warning that local configuration will be modified. In a self-auditing security skill, this is more dangerous because users are primed to expect safe diagnostic behavior, making silent or underexplained writes more likely to be trusted.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The sample output says "No changes were made to your configuration" even though the README promotes a --fix mode that can alter settings and permissions. Misleading output examples can cause users to miss that a run was capable of making changes, reducing auditability and informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Advertising a --fix mode inside a skill framed as a read-only audit creates an inconsistent safety model. Even if the file is primarily documentation, agent ecosystems often derive operational behavior from such instructions, so the inconsistency can induce unsafe execution of modifying commands without adequate safeguards.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

How to detect:

bash

ls -la ~/.clawdbot/credentials/
ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null
stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

How to detect:

bash

ls -la ~/.clawdbot/credentials/
ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null
stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

How to detect:

bash

ls -la ~/.clawdbot/credentials/
ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null
stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

How to detect:

bash

ls -la ~/.clawdbot/credentials/
ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null
stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

How to detect:

bash

ls -la ~/.clawdbot/credentials/
ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null
stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

Remediation:

bash

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/credentials/oauth.json
chmod 600 ~/.clawdbot/clawdbot.json

Static analysis

No suspicious patterns detected.