ClawHub
Back to skill

Security audit

ListenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill’s voice-formatting instructions are narrow and benign, but its installer downloads and overwrites the installed skill from a mutable GitHub branch without integrity verification.

Review is recommended before installing. The voice-formatting skill itself is narrow, but run the installer only if you trust the GitHub repository at install time; a safer installer would use the bundled SKILL.md or pin and verify the remote file before replacing your local skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
install.sh:23
Finding

Mutable Remote Skill Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose describes runtime behavior for formatting assistant responses for voice/TTS use. The actual code does not implement response formatting, trigger handling, or voice-output transformation. Instead, it performs installation steps: selecting a workspace based on agent name, creating a skills directory, fetching a remote SKILL.md file, and writing it locally. These are materially different capabilities from the declared purpose and include undeclared network and filesystem modification behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 23)May include surrounding context.

sh
exit 1
fi

mkdir -p "$SKILL_DIR"

curl -fsSL https://raw.githubusercontent.com/tinywatermonster/listenclaw/main/listenclaw/SKILL.md \
  -o "${SKILL_DIR}/SKILL.md"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script fetches content from GitHub via curl and saves it into the user's workspace, which are safety-relevant network and file-write operations. While the script prints the final install location, it does not clearly disclose beforehand that it will download remote content and overwrite or create SKILL.md at that path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.