T03 · Remote Payload Retrieval and Execution
Error
- Location
references/setup.md:27- Finding
Unverified Remote Installer Executed Directly Through a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawdbot Sync
Security checks for vulnerabilities and agentic risk
Overview
This sync skill does what it says at a high level, but it handles sensitive agent memory and remote SSH writes with weak safeguards that users should review before installing.
Install only if you trust every peer and are comfortable syncing agent memory/profile data between machines. Before use, replace the Tailscale install one-liner with verified package-manager instructions, pin or verify SSH host keys, restrict peers to a dedicated low-privilege account and workspace path, run /sync diff before any transfer, and avoid pulling or bidirectional syncing persistent memory files without reviewing changes and keeping backups.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/handler.sh:163- Finding
Command Injection Through Unvalidated Peer Path Configuration
- Content
View full analysis
/dev/null; then conn_test="success" else conn_test="failed" fi # Add peer jq --arg name "$name" --arg host "$host" --arg user "$user" --arg path "$remote_path" \ '.peers[$name] = {"host": $host, "user": $user, "path": $path, "addedAt": (now | strftime("%Y-%m-%dT%H:%M:%SZ"))}' \ "$PEERS_FILE" > "$PEERS_FILE.tmp" && mv "$PEERS_FILE.tmp" "$PEERS_FILE" ``` The stored path is later inserted unquoted into a command interpreted by the remote shell: ```bash for sync_path in "${SYNC_PATHS[@]}"; do local_path="$WORKSPACE/$sync_path" remote="$user@$host:$remote_path/$sync_path" [[ ! -e "$local_path" ]] && continue # Ensure remote directory exists if [[ "$sync_path" == */ ]]; then ssh -o BatchMode=yes "$user@$host" "mkdir -p $remote_path/$sync_path" 2>/dev/null || true fi # Sync result=$(rsync -avz $exclude_args "$local_path" "$remote" 2>&1) || errors="$errors\n$result" ``` The bidirectional synchronization path contains the same unsafe interpolation: ```bash for sync_path in "${SYNC_PATHS[@]}"; do local_path="$WORKSPACE/$sync_path" remote="$user@$host:$remote_path/$sync_path" # Ensure directories exist if [[ "$sy ...[truncated 2512 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/handler.sh:66- Finding
SSH Peer Authenticity Verification Is Disabled
- Content
View full analysis
/dev/null && return 0 return 1 } ``` ### Technical Analysis The connection check explicitly sets `StrictHostKeyChecking=no`. This removes the normal interactive authenticity decision for unknown SSH host keys and can silently accept an attacker's key during initial peer onboarding. The check is invoked while adding peers and before bidirectional synchronization. Although later SSH or rsync invocations may still use the client's default host-key policy, accepting an attacker-controlled key during the initial check can establish the malicious key as the stored identity for later operations. The exact behavior for changed keys depends on the local SSH client configuration, but first-connection impersonation remains a material risk. Because the synchronized data includes memory and user-profile files, peer authenticity is a core security requirement rather than an optional connection convenience. ### Attack Path 1. A user adds or connects to a peer whose host key has not previously been pinned. 2. An attacker capable of network interception impersonates the peer address. 3. The connection check runs with `StrictHostKeyChecking=no`. 4. The attacker's SSH host key can be accepted without explicit fingerprint verification. 5. The attacker operates a service matching the expected peer account or otherwise captures the onboarding attempt. 6. Subsequent push, pull, or sync operations may transfer Agent memory and profile data to the impersonated peer or retrieve attacker-controlled files from it. ### Impact Assessment An attacker who successfully impersonates ...[truncated 369 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
scripts/handler.sh:34- Finding
Unreviewed Peer Content Can Poison Persistent Agent Memory
- Content
View full analysis
/dev/null || true ssh -o BatchMode=yes "$user@$host" "mkdir -p $remote_path/$sync_path" 2>/dev/null || true fi # Push newer local files if [[ -e "$local_path" ]]; then result=$(rsync -avzu $exclude_args "$local_path" "$remote" 2>&1) || true count=$(echo "$result" | grep -cE "^[<>ch]" || echo "0") pushed=$((pushed + count)) fi # Pull newer remote files result=$(rsync -avzu $exclude_args "$remote" "$local_path" 2>&1) || true count=$(echo "$result" | grep -cE "^[<>ch]" || echo "0") pulled=$((pulled + count)) done ``` ### Technical Analysis Synchronizing memory is the declared purpose of the Skill, so access to workspace memory is functionally necessary. However, the implementation trusts peer content solely according to rsync's update behavior and file timestamps. It does not require a content diff, user approval, cryptographic integrity manifest, trusted-author policy, or backup before replacing local persistent state. `MEMORY.md`, `USER.md`, and `HEARTBEAT.md` can contain information or instructions used by an Agent across sessions. A compromised or malicious peer can create newer versions containing attacker-selected directives. On ...[truncated 1575 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code substantially matches the core declared purpose of syncing data between Clawdbot instances over SSH/rsync and supports bi-directional sync, peer management, diffing, and history. However, the description overstates scope: the implementation only syncs a fixed set of paths (memory/ and a few markdown files) and does not include any explicit skill synchronization mechanism, even though the description says it synchronizes skills. Preferences are only partially represented through specific files rather than a general preference store. Additionally, the human-readable description lists trigger phrases, but the formal trigger list is empty. These are material description-to-behavior mismatches, though the primary purpose is otherwise aligned.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Fetching and executing a shell script directly from the internet creates a direct code-execution path with no inspection or authenticity verification. In a sync-oriented skill that establishes network connectivity between machines, compromise of this install step could lead to persistent access across multiple systems.
- Content
bash # Install Tailscale curl -fsSL https://tailscale.com/install.sh | sh # Login tailscale up
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The '| sh' construct is the dangerous execution step that turns remote content retrieval into immediate shell execution. This pattern is especially risky here because the skill is about cross-host synchronization and SSH trust setup, so successful compromise can grant broad access and propagate to connected systems.
- Content
bash # Install Tailscale curl -fsSL https://tailscale.com/install.sh | sh # Login tailscale up
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Permission Denied - Ensure SSH keys are set up - Check authorized_keys permissions: `chmod 600 ~/.ssh/authorized_keys` ### Tailscale Not Connected - Check status: `tailscale status`
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script builds rsync arguments with
--delete, which can remove files during synchronization, but there is no confirmation prompt or user-visible warning in the code before push, pull, or diff-related destructive behavior is prepared. Because this is a shell skill performing cross-system file synchronization, silent deletion is a safety-critical operation that should be explicitly disclosed.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This push path copies local memory files to a remote system and can overwrite or delete remote data via rsync semantics without any interactive confirmation, preview enforcement, or conflict handling. In this skill's context, the synchronized content includes agent memory and user preference files, so unintended execution could leak sensitive data to another host or corrupt the remote bot state.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The pull operation writes remote content into local workspace files without confirmation, integrity checks, or conflict resolution. Because the synced targets include memory and instruction-like files, a compromised or incorrect peer could inject malicious or misleading content into the local agent's persistent state.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The bidirectional sync path modifies both local and remote state automatically based on timestamps, with no confirmation, no conflict management, and no trustworthy peer verification. In this skill context, that is especially dangerous because it propagates persistent memory and behavioral artifacts across agent instances, amplifying corruption, data leakage, or prompt/state poisoning between bots.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises broad natural-language triggers such as 'share this with my other bot' and 'update other clawdbot', which can match ordinary conversation and cause sync actions to be invoked in contexts where the user did not intend a cross-machine transfer. In a sync skill, accidental activation is risky because it may propagate memory, profile data, or installed content to another host over SSH without an explicit, narrowly scoped confirmation step.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes bi-directional synchronization of memory and related files but does not prominently warn that sync can overwrite local state or propagate sensitive user data across machines. In this context, the omission is security-relevant because memory, USER.md, and optional skills may contain private or security-sensitive information, and bidirectional sync increases the chance of unintended disclosure or destructive overwrites.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup guide instructs users to pipe a remote script directly into the shell without any integrity verification, review step, or pinning to a trusted artifact. If the remote content, transport path, or publishing account is compromised, arbitrary code would execute immediately on the user's machine.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Connection Refused - Check SSH is running: `systemctl status ssh` - Check firewall: `sudo ufw allow ssh` ### Permission Denied - Ensure SSH keys are set up
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Permission Denied - Ensure SSH keys are set up - Check authorized_keys permissions: `chmod 600 ~/.ssh/authorized_keys` ### Tailscale Not Connected - Check status: `tailscale status`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script performs remote shell execution over SSH to create directories on the peer, but it does so silently and with unescaped command interpolation. In an agent context, this can cause user-unexpected remote side effects and increases risk if peer configuration values contain shell metacharacters or point to unintended hosts.
- Content
Static analysis
No suspicious patterns detected.