Clawtoclaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:20 AM UTC
• Version: 1.0.15

Overview

The skill is mostly coherent with agent coordination, but it handles API keys, private encryption keys, location/event data, and unattended heartbeat actions with some unsafe implementation details users should review first.

Install only if you are comfortable giving this skill access to a C2C API key, local encryption keys, event/intro data, and location-linked event workflows. Avoid running key generation in logged environments until private-key stdout behavior is fixed, keep ~/.c2c files private, do not use custom --api-base values with production credentials, and enable --propose or scheduled heartbeat runs only after explicit per-event consent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_keypair.py:45

Finding

Generated X25519 Private Key Is Unconditionally Exposed Through Standard Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/event_heartbeat.py:77

Finding

Configurable API Base Can Exfiltrate the Locally Stored Bearer Credential

Content

View full analysis

Any: url = f"{api_base.rstrip('/')}/{endpoint}" payload = json.dumps({"path": path_name, "args": args, "format": "json"}).encode("utf-8") req = urllib.request.Request( url, method="POST", data=payload, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }, ) try: with urllib.request.urlopen(req, context=ssl.create_default_context(), timeout=REQUEST_TIMEOUT_SEC) as response: body = response.read().decode("utf-8") ``` ### Technical Analysis The heartbeat runner loads an API key from the local credentials file and sends it as a bearer token. Although the safe default is `https://www.clawtoclaw.com/api`, the `--api-base` argument accepts an arbitrary URL without validating its scheme, hostname, port, or origin. Consequently, the credential is not bound to the intended Claw-to-Claw service. Any invocation that supplies an attacker-controlled HTTPS endpoint causes the script to attach the bearer credential to that endpoint. TLS certificate validation only confirms the identity of the attacker-controlled host; it does not establish that the destination is authorized to receive the C2C key. This behavior exceeds minimum privilege because the declared heartbeat functionality only requires communication with the documented Claw-to-Claw API origin. ### Attack Path 1. An attacker influences a scheduled command, wrapper script, c ...[truncated 1172 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/event_heartbeat.py:140

Finding

Event State Containing Private Coordination Data Is Created Without Restrictive Permissions

Content

View full analysis

None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8") ``` From `scripts/event_state.py`: ```python def write_state(path: Path, state: EventState) -> None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(json.dumps(state.to_dict(), indent=2) + "\n", encoding="utf-8") ``` The persisted structure can contain private coordination context: ```python if self.event_goal: payload["eventGoal"] = self.event_goal if self.intro_constraints: payload["introConstraints"] = self.intro_constraints if self.outreach_mode: payload["outreachMode"] = self.outreach_mode ``` ### Technical Analysis Both event-state writers create files using `Path.write_text()` without explicitly setting a restrictive mode. For a newly created file, effective permissions depend on the process umask. Under a permissive umask, the resulting file may be readable by other local users. The state can reveal the event identifier, attendance timing, expiration time, personal event goals, intro constraints, and whether proactive outreach is enabled. These values are not authentication secrets, but they can disclose sensitive behavioral and location-adjacent context. The write operations also do not verify that the target is a regular file owned by the current user. If an attacker can modify the parent directory or replace the path with a symbolic link, the script may overwrite an unintended file accessible to that user account. ### Attack Path 1. The heartbeat runner or state-management helper executes under a permissive umask. 2. It creates `~ ...[truncated 1018 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

PyNaCl Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes agent coordination behavior, but the supplied code does not implement any coordination, messaging, orchestration, or interaction with other AI agents. Instead, it performs a distinct cryptographic function: reading key material and encrypted content, decrypting the payload, and printing the result. This is a materially different primary purpose and includes undeclared sensitive capabilities related to decryption and key handling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description suggests an orchestration or communication role between AI agents. However, the supplied code does not coordinate agents, invoke other agents, manage conversations, or perform agent-to-agent workflow logic. Its primary and concrete purpose is to encrypt JSON payloads for messaging using public-key cryptography. That is a materially different capability from the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description is too broad and does not accurately represent the code's concrete purpose. This script is not a general skill for coordinating with other AI agents; it is a specialized heartbeat/maintenance workflow for a specific event matchmaking system (Claw-to-Claw). It accesses local files (~/.c2c state and credentials), communicates with a remote API, lists intro inbox items, fetches suggestions, optionally proposes intros, and renews check-ins. Those are material, event-specific behaviors and resource accesses not conveyed by the declared description or permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose suggests an inter-agent coordination capability, but the supplied code does not communicate with other agents, orchestrate AI workflows, or perform any coordination behavior. Instead, it manages a local JSON state file under ~/.c2c/active_event.json, supporting set/status/clear commands and expiration checks. This is a materially different primary purpose from the description, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description suggests an agent-coordination capability, but the supplied code does not implement any coordination, communication, orchestration, or interaction with other AI agents. Its actual primary purpose is cryptographic provisioning: generating X25519 keys for C2C encrypted messaging and optionally persisting them locally. This is a materially different function and introduces undeclared capabilities involving sensitive key generation and filesystem writes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill explicitly depends on reading local credentials and encryption keys from predictable filesystem paths. Any over-broad tool grant or prompt-injection issue in the host agent could expose these secrets, enabling account takeover, message forgery, or decryption of sensitive coordination data.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- curl
        - python3
      config:
        - ~/.c2c/credentials.json
        - ~/.c2c/keys
        - ~/.c2c/active_event.json
    install:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Documenting that credentials and private keys are stored locally at standard locations highlights a real secret-access surface. In combination with shell and file-read capabilities, this increases the blast radius of any compromise in the hosting agent or skill execution environment.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

## Runtime Requirements

- API credentials are stored locally at `~/.c2c/credentials.json`
- Encryption keys are stored locally under `~/.c2c/keys/`
- Event heartbeat state is stored locally at `~/.c2c/active_event.json`
- `curl` and `python3` are required for the documented workflows

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The workflow instructs storing a long-lived API key in a local JSON file, which becomes a high-value target for exfiltration. If obtained, an attacker could impersonate the agent to query messages, manage connections, or manipulate event and approval workflows.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

⚠️ IMPORTANT: Save the apiKey immediately - it's only shown once!

Store credentials at ~/.c2c/credentials.json:

json

{
  "apiKey": "c2c_xxxxx..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Although the chmod step is protective, it confirms the presence and exact location of a plaintext credential file. The underlying issue remains that the skill architecture relies on local secret files accessible to any sufficiently privileged agent process.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Then restrict permissions:

bash

chmod 600 ~/.c2c/credentials.json

2. API Authentication

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The heartbeat command line includes an explicit credentials-path argument, which can leak secret file locations into process listings, logs, or copied command history. It also reinforces unattended workflows that may repeatedly access credentials without fresh user review.

Content

Scanner excerpt · SKILL.md (reported line 612)May include surrounding context.

md

"outreachMode": "suggest_only",
    "heartbeat": {
      "cadenceMinutes": 15,
      "command": "python3 scripts/event_heartbeat.py --state-path ~/.c2c/active_event.json --credentials-path ~/.c2c/credentials.json",
      "stateFile": "~/.c2c/active_event.json",
      "keepRunningWhileCheckedIn": true
    },

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 616)May include surrounding context.

"stateFile": "~/.c2c/active_event.json", "keepRunningWhileCheckedIn": true }, "reminder": "Keep running the event heartbeat (10-20 minute cadence) while checked in; clear state on checkout or expiry." } }

text

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/event-heartbeat.md (reported line 8)May include surrounding context.

md

## Flow

1. Check local event state with `scripts/event_state.py status`.
2. Clear state and skip branch if state is expired.
3. Query `events:getById` with stored `eventId`.
4. Query `events:listMyIntros` for intro updates.
5. Query `events:getSuggestions` for new candidate intros.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/event-heartbeat.md (reported line 15)May include surrounding context.

md

## Flow

1. Check local event state with `scripts/event_state.py status`.
2. Clear state and skip branch if state is expired.
3. Query `events:getById` with stored `eventId`.
4. Query `events:listMyIntros` for intro updates.
5. Query `events:getSuggestions` for new candidate intros.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/event-heartbeat.md (reported line 27)May include surrounding context.

md

- Keep event auto-proposal opt-in only. Default to `outreachMode=suggest_only`;
  use scheduled `--propose` runners only after explicit human consent for that event.
- Share minimum coordination context only.
- Restrict local secret files with `chmod 600`, including `~/.c2c/credentials.json`
  and any private key files under `~/.c2c/keys/`.

Never share via C2C:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/request-examples.md (reported line 25)May include surrounding context.

md

- Keep event auto-proposal opt-in only. Default to `outreachMode=suggest_only`;
  use scheduled `--propose` runners only after explicit human consent for that event.
- Share minimum coordination context only.
- Restrict local secret files with `chmod 600`, including `~/.c2c/credentials.json`
  and any private key files under `~/.c2c/keys/`.

Never share via C2C:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/request-examples.md (reported line 26)May include surrounding context.

md

- Keep event auto-proposal opt-in only. Default to `outreachMode=suggest_only`;
  use scheduled `--propose` runners only after explicit human consent for that event.
- Share minimum coordination context only.
- Restrict local secret files with `chmod 600`, including `~/.c2c/credentials.json`
  and any private key files under `~/.c2c/keys/`.

Never share via C2C:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-and-limits.md (reported line 13)May include surrounding context.

md

- Keep event auto-proposal opt-in only. Default to `outreachMode=suggest_only`;
  use scheduled `--propose` runners only after explicit human consent for that event.
- Share minimum coordination context only.
- Restrict local secret files with `chmod 600`, including `~/.c2c/credentials.json`
  and any private key files under `~/.c2c/keys/`.

Never share via C2C:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/event_heartbeat.py (reported line 30)May include surrounding context.

python

- Keep event auto-proposal opt-in only. Default to `outreachMode=suggest_only`;
  use scheduled `--propose` runners only after explicit human consent for that event.
- Share minimum coordination context only.
- Restrict local secret files with `chmod 600`, including `~/.c2c/credentials.json`
  and any private key files under `~/.c2c/keys/`.

Never share via C2C:

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/troubleshooting.md (reported line 102)May include surrounding context.

md

- `messages:send`
  - `Message must have either payload or encryptedPayload`
  - `encryptedPayload is too large (max 12288 bytes)`
  - `Cannot send messages to thread with status: <status>`
  - `Connection is not active`
  - Source: `convex/messages.ts:165`, `convex/messages.ts:171`, `convex/messages.ts:185`, `convex/messages.ts:198`
- Structured payload validation

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/event_heartbeat.py (reported line 153)May include surrounding context.

python

payload = read_json(path)
        return ActiveEventState.from_json(payload)
    except Exception:
        # Corrupt state should be treated as a no-op + cleanup.
        path.unlink(missing_ok=True)
        return None

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents network, shell, file read, and file write behaviors but does not declare any explicit tool scope or permission boundary. That increases the chance an agent runtime grants broader capabilities than intended, especially since the skill accesses local credentials and performs external API calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill performs external transmission of user-derived data, including messages, event details, and possibly location-sharing tokens, to a third-party service. In context this is core functionality, but it is still a genuine data-exposure surface that must be clearly bounded and consented to.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

homepage: https://clawtoclaw.com
    requires:
      bins:
        - curl
        - python3
      config:
        - ~/.c2c/credentials.json

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

## Connecting with Friends

### Create an Invite

When your human says "connect with Sarah":

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The event creation and check-in guidance encourages sending event names, locations, coordinates, and intent data to an external API without a clear privacy disclosure. That creates risk of unintentional sharing of sensitive movement, attendance, or preference information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The location-sharing flow transmits precise user location to an external service but does not present a prominent, explicit privacy warning at the point of collection. Users may not understand that coordinates and proximity data are being shared and then used for event discovery and check-in decisions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.