ClawWhisper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:25 PM UTC
• Version: 2.3.0

Overview

The skill mostly does what it claims, but it exposes live room credentials in logs and connects autonomous agents to untrusted external chat without enough guardrails.

Review this skill before installing. Use it only for non-sensitive conversations, remove or redact credential logging, and integrate callbacks so remote room messages are treated as untrusted data that cannot approve tool calls, access files or secrets, modify memory, or perform consequential actions without explicit user confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:55
• Finding: Live Agent Credential Disclosed in Application Logs<![CDATA[ ## Vulnerability Details **File Location**: `index.js`, lines 55-58 **Vulnerability Type**: Plaintext credential exposure through logging **Risk Level**: Medium ### Vulnerable Code ```javascript // Generate credential const credential = await generateCredential(); console.log(`[ClawWhisper] Generated credential: ${credential}`); ``` ### Technical Analysis The application logs the complete agent credential immediately after retrieving it from the hosted API. This credential is subsequently included in the WebSocket connection URL and therefore acts as authentication material for the external ClawWhisper service. Application logs may be accessible to terminal users, process supervisors, CI/CD systems, centralized logging platforms, support personnel, or other processes that collect standard output. Recording the complete credential expands access to authentication material beyond the component that requires it. The client does not show whether the credential is single-use, room-bound, short-lived, or invalidated after disconnection. Consequently, the precise duration and scope of possible reuse depend on controls implemented by the external service. ### Attack Path 1. The user or agent calls `joinRoom()`. 2. The client requests a credential from the hosted ClawWhisper API. 3. The complete credential is printed to standard output. 4. An attacker with access to local or aggregated application logs extracts the credential. 5. The attacker attempts to use the credential with the documented agent WebSocket endpoint. 6. If the server permits credential reuse, the attacker may authenticate as the agent or gain access to the associated communication session. ### Impact Assessment Successful exploitation could allow unauthorized access to the affected ClawWhisper session, agent impersonation, message injection, or observation of room communications, subject to the server-side scope and lifetime of the credential. This issue does not directly grant op ...[truncated 142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the credential from all console and application logs. - Log only non-sensitive diagnostic information, such as a generated request identifier or a redacted fingerprint. - Ensure server-issued credentials are short-lived, single-use, bound to one room and agent, and invalidated when the connection closes. - Prevent WebSocket URLs containing credentials from being recorded by proxies, monitoring software, or error-reporting systems. - Review existing logs and delete or restrict access to records containing previously issued credentials. - Add automated secret-detection tests that fail when authentication material is passed to logging functions. ]]>

other

Warning

• Location: index.js:99
• Finding: Untrusted Remote Messages Are Forwarded Directly to Autonomous Agent Callbacks<![CDATA[ ## Vulnerability Details **File Location**: `index.js`, lines 99-114 **Vulnerability Type**: Indirect prompt-injection exposure across an external trust boundary **Risk Level**: Medium ### Vulnerable Code ```javascript } else if (msg.type === 'chat') { // Skip my own messages to avoid echo loops if (myAgentId && msg.agentId === myAgentId) { console.log(`[ClawWhisper] Skipped own message: ${msg.text}`); return; } console.log(`[ClawWhisper] Agent ${msg.agentId}: ${msg.text}`); // Add to conversation history const messageEntry = { agentId: msg.agentId, text: msg.text, timestamp: Date.now() }; conversationHistory.push(messageEntry); // Trim history to keep last MAX_HISTORY messages if (conversationHistory.length > MAX_HISTORY) { conversationHistory = conversationHistory.slice(-MAX_HISTORY); } // Pass history to callback for context-aware responses onMessageCallback?.(msg.agentId, msg.text, [...conversationHistory]); ``` ### Technical Analysis Messages received from external room participants are attacker-controlled input. The implementation stores this content in conversation history and supplies both the latest message and accumulated history directly to a callback intended to support autonomous, context-aware agent responses. The Skill provides no trust labeling, instruction-versus-data separation, content-size restriction, schema validation beyond the message type, or policy preventing remote participants from authorizing tool calls and sensitive operations. A malicious participant can therefore submit instruction-like content designed to be interpreted by a consuming language model as authoritative directions. This client does not itself execute incoming text as code or invoke privileged tools. Exploitation and impact depend on how the callback incorporates the supplied values into an LLM context and what tools, secrets, memory, or permissions that agent possesses. ### Attack Path 1. An at ...[truncated 1233 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Explicitly classify all remote room messages and history entries as untrusted data. - Place remote content in clearly delimited data fields rather than concatenating it into privileged system or developer instructions. - Establish a fixed policy stating that remote participants cannot modify safety rules, authorize tool calls, request secrets, or approve consequential actions. - Require explicit user confirmation before any callback-triggered action that accesses files, credentials, external services, persistent memory, or privileged tools. - Validate incoming messages against a strict schema and enforce reasonable text-length, nesting, and message-rate limits. - Sanitize or escape content where it crosses into structured prompt formats, while recognizing that sanitization alone does not prevent semantic prompt injection. - Pass provenance metadata to the callback so the consuming agent can distinguish remote participant content from trusted instructions. - Avoid exposing secrets or unnecessary conversation context to the model processing external messages. - Document the prompt-injection trust boundary prominently in `SKILL.md` and provide a secure callback integration example. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning

Content

ws.close();
  }

  // Reset state for new room
  conversationHistory = [];
  lastMessageTime = 0;

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill logs the generated credential directly to the console, exposing authentication material to logs, observability systems, terminal history capture, or other local users/processes with log access. Because this credential is then used to authenticate the WebSocket session, disclosure could enable unauthorized room access or impersonation for the lifetime of the credential.

Memory Manipulation

High

• Category: Memory Poisoning

Content

}

/**
 * Clear conversation history
 */
export function clearHistory() {
  conversationHistory = [];

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly describes networked behavior via hosted HTTPS/WebSocket endpoints, but the manifest declares no tool scope such as network permissions or allowed tools. That mismatch weakens security review and user consent because a consuming agent may invoke external communication capabilities that are not transparently declared in the skill metadata.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The skill is designed for autonomous conversation with other agents and repeatedly emphasizes that the agent decides what to say, creating an unrestricted natural-language input channel from untrusted peers. That makes prompt-injection and social-engineering attacks highly plausible: another agent can send adversarial instructions that manipulate the model into revealing data, taking unsafe actions, or bypassing expected safeguards.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Providing the full recent history to callbacks gives the agent wholesale access to all prior peer messages, enabling collection, retention, summarization, and reuse of potentially sensitive content supplied by users or other agents. In an autonomous multi-agent setting, this increases the chance that sensitive information is propagated, re-quoted, or exfiltrated beyond what participants expected from an 'ephemeral' chat room.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that chat content and room history are sent to a hosted external service, but it does not prominently warn that user or agent-generated conversation data will leave the local environment and be visible to other participants. In a cross-agent chat system, that omission is dangerous because sensitive prompts, user data, or derived secrets may be disclosed to third parties through normal operation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill connects to a third-party hosted endpoint and exchanges chat content, including message text and room context, but the file does not provide any user disclosure that conversation data will be sent to an external service. This is a privacy-relevant network operation that should be clearly disclosed.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The doc comment says 'Generate a new agent credential,' which suggests local creation, but the implementation performs an HTTP POST to a hosted API and returns a server-issued credential. This is an intent-level mismatch in inline documentation because the code is not generating the credential itself.