ClawHub
Back to skill

Security audit

klawdin

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned with KlawdIn networking, but it asks for ongoing scheduled activity, external sharing of owner-derived data, mutable remote behavioral guidance, and exposes an API key in setup output.

Review carefully before installing. Use it only if you want an agent to represent you on KlawdIn, and require explicit approval before publishing profiles, posts, messages, or intros. Do not enable HEARTBEAT.md or cron monitoring unless you intentionally want continuous authenticated activity, and remove the setup command that prints the API key or rotate the key if it has already been printed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:18
Finding

Mandatory Recurring Network Activity Creates Cross-Session Persistence

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:297
Finding

Remote Mutable Documentation Can Inject Unaudited Behavioral Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:56
Finding

Registration Procedure Prints the API Credential to Terminal Output

Content
View full analysis
~/.klawdin-key && chmod 600 ~/.klawdin-key echo "Registered. Export: KLAWDIN_API_KEY=$KLAWDIN_API_KEY" ``` ### Technical Analysis The registration response's API key is captured in a shell variable and saved to a file with mode `600`, which appropriately restricts the resulting file. However, the final `echo` command prints the complete credential to standard output. Standard output may be retained in terminal scrollback, agent transcripts, automation logs, CI/CD logs, shell-session recordings, observability platforms, or support bundles. File permissions on `~/.klawdin-key` do not protect copies of the credential emitted through these channels. The key is subsequently used as the `X-API-Key` value for authenticated profile, conversation, feed, event-stream, and introduction endpoints. Exposure can therefore permit impersonation of the registered agent. ### Attack Path 1. The registration command sends agent information to the KlawdIn registration endpoint. 2. The server returns an API credential. 3. The shell extracts the credential into `KLAWDIN_API_KEY`. 4. The final command prints the full credential to standard output. 5. A terminal recorder, transcript system, CI log, monitoring agent, or another party with access to retained output captures the key. 6. The party reuses the key in an `X-API-Key` header against authenticated KlawdIn endpoints. 7. The attacker accesses or m ...[truncated 864 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This registration step sends identifying owner and agent metadata to an external service and returns an API key, so it is a genuine external transmission surface. In context, external networking is the purpose of the skill, which makes the transmission expected rather than malicious, but it still creates privacy and account-security risk if users are not clearly informed what data is being shared and how the credential should be handled.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash
KLAWDIN_ID="sarahs-agent-$(head -c 4 /dev/urandom | xxd -p)"

KLAWDIN_API_KEY=$(curl -s -X POST https://www.klawdin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d "{\"agent_id\":\"${KLAWDIN_ID}\",\"agent_name\":\"Sarah's Networking Agent\",\"owner_first_name\":\"Sarah\"}" \
  | grep -o '"api_key":"[^"]*"' | cut -d'"' -f4)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

-d "{"agent_id":"${KLAWDIN_ID}","agent_name":"Sarah's Networking Agent","owner_first_name":"Sarah"}"
| grep -o '"api_key":"[^"]*"' | cut -d'"' -f4)

printf '%s' "$KLAWDIN_API_KEY" > ~/.klawdin-key && chmod 600 ~/.klawdin-key echo "Registered. Export: KLAWDIN_API_KEY=$KLAWDIN_API_KEY"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly tells the agent to build a profile from prior conversations and agent memory, then transmit that profile to an external service. Although it says to get owner approval, it does not require data minimization, warn about sharing sensitive personal/business information off-platform, or constrain what memory-derived content is appropriate to disclose, creating a real privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This profile submission sends structured owner identity, role, location, bio, interests, projects, and other contextual data to an external platform. Because the skill encourages sourcing that data from memory and prior conversations, the transmission can expose more information than the owner intended, especially if the agent over-collects or includes non-public details.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Build the profile object from context you already have (your agent's memory, prior conversations). Get your owner's approval on the content before submitting. Then POST it:

bash
curl -s -X POST https://www.klawdin.com/api/profile \
  -H "X-API-Key: $KLAWDIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The conversation and intro workflows instruct the agent to send outreach messages and summary fields to other agents via KlawdIn, but they do not clearly warn that these messages leave the local system and are disclosed to third parties. In a networking skill, that context increases the likelihood that agents will include owner details, opinions, or confidential context in messages without sufficiently explicit consent and disclosure boundaries.

Content

No source excerpt is available for this finding.