ClawHub
Back to skill

Security audit

Become Ceo

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for running a Discord AI team, but its default setup gives broad Discord invocation access and relies on an unpinned global npm install with API tokens in scope.

Install only if you are comfortable reviewing and controlling the Discord deployment yourself. Pin and review the clawdbot package version, protect all Discord and LLM tokens, restrict bots to trusted guilds/channels/roles/users, and avoid granting finance, legal, DevOps, or engineering agents powerful tools until authorization and audit controls are in place.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 18
Vulnerability Type: Unpinned third-party dependency with installation-time code execution
Risk Level: High

Vulnerable Code Snippets:

yaml
metadata: {"clawdbot":{"emoji":"🏛️","requires":{"bins":["clawdbot"]},"credentials":["LLM_API_KEY","DISCORD_BOT_TOKEN"],"configs":["~/.clawdbot/clawdbot.json"],"install":[{"id":"node","kind":"node","package":"clawdbot","bins":["clawdbot"],"label":"Install Clawdbot"}]}}
markdown
1. Install Clawdbot: `npm install -g clawdbot`

Technical Analysis

The Skill directs users to install the mutable latest release of the third-party clawdbot package globally without an exact version or integrity verification. npm installations may execute package-controlled lifecycle scripts, including preinstall, install, and postinstall.

Because neither the metadata installation declaration nor the Quick Start command pins a reviewed release, the effective code installed can change after this Skill has been audited. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream change could therefore introduce arbitrary code into the installation process.

Global installation increases exposure because the package is placed in the user's global npm environment and its executable becomes available through the user's command search path.

Attack Path

  1. An attacker compromises the upstream npm package, its publisher account, or the package's release process.
  2. The attacker publishes a modified version containing a malicious lifecycle script or executable.
  3. A user follows the documented command npm install -g clawdbot, which resolves the latest available release.
  4. npm downloads the attacker-controlled release and may execute its lifecycle scripts during installation.
  5. The payload runs with the privileges of the user performing the installation. 6 ...[truncated 820 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin clawdbot to a specific, reviewed version in both the metadata and installation instructions, such as clawdbot@X.Y.Z.
  • Record and verify the expected package integrity hash or use a lockfile-backed installation workflow.
  • Document the trusted npm registry and reject unexpected registry overrides.
  • Review the selected package version and its transitive dependencies before publication.
  • Prefer a project-local installation over a global installation where feasible.
  • Run installation in a restricted environment without production credentials.
  • Consider disabling lifecycle scripts during dependency acquisition with --ignore-scripts, followed by an explicit review of any required setup steps.
  • Establish an update process that requires review and integrity verification before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/clawdbot-template.json:102
Finding

Open Discord Group Policy Permits Invocation Without an Explicit Authorization Allowlist

Content
View full analysis

Vulnerability Details

File Location: references/clawdbot-template.json, lines 102-112; reinforced by SKILL.md, lines 40 and 69
Vulnerability Type: Overly permissive Discord access-control configuration
Risk Level: Medium

Vulnerable Code Snippet:

json
"channels": {
  "discord": {
    "enabled": true,
    "groupPolicy": "open",
    "historyLimit": 20,
    "accounts": {
      "main":        { "name": "Chief of Staff", "token": "$DISCORD_BOT_TOKEN_MAIN",        "groupPolicy": "open" },
      "engineering": { "name": "Engineering",    "token": "$DISCORD_BOT_TOKEN_ENGINEERING",  "groupPolicy": "open" },
      "finance":     { "name": "Finance",        "token": "$DISCORD_BOT_TOKEN_FINANCE",      "groupPolicy": "open" },
      "marketing":   { "name": "Marketing",      "token": "$DISCORD_BOT_TOKEN_MARKETING",    "groupPolicy": "open" },
      "devops":      { "name": "DevOps",         "token": "$DISCORD_BOT_TOKEN_DEVOPS",       "groupPolicy": "open" },
      "management":  { "name": "Management",     "token": "$DISCORD_BOT_TOKEN_MANAGEMENT",   "groupPolicy": "open" },
      "legal":       { "name": "Legal",           "token": "$DISCORD_BOT_TOKEN_LEGAL",        "groupPolicy": "open" }
    },

The documentation also makes the permissive setting mandatory:

markdown
- Each Discord account **MUST** have `"groupPolicy": "open"` — does NOT inherit from global

Technical Analysis

The global Discord channel and all seven bot accounts use an open group policy. The Skill does not define an explicit allowlist of trusted Discord users, roles, channels, or groups.

The configured guild requires a mention, which reduces unsolicited bot activation but is not an authorization control. Any participant able to communicate in an accepted Discord context and mention a bot may still be able to submit instructions to the corresponding agent.

This unnecessarily expands the trust boundary of ag ...[truncated 1640 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the open group policy with a deny-by-default or allowlist-based policy.
  • Explicitly restrict access by trusted guild, channel, role, and user identifiers.
  • Apply authorization controls independently to every Discord bot account rather than relying only on a global setting.
  • Retain requireMention as a secondary anti-noise control, not as a substitute for authorization.
  • Restrict Discord bot invitations and server permissions to the minimum required.
  • Separate high-impact agents, particularly DevOps and Finance, into tightly controlled private channels.
  • Apply least-privilege tool permissions to each agent and require confirmation for external, destructive, financial, or deployment actions.
  • Add rate limits, usage quotas, audit logging, and alerts for unexpected users or unusually high model consumption.
  • Update SKILL.md so that secure allowlisting is the documented default instead of requiring "groupPolicy": "open".

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file explicitly sets the user's language to English, which can override or bias the agent against honoring a user's actual language preference. In a multi-agent Discord workspace, this can lead to exclusion, misunderstanding, or reduced usability for non-English users, even if it is not a direct code-execution security issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The Discord configuration sets groupPolicy to open at both the channel level and for every bot account, which can allow broad participation by multiple agents in group contexts without strong per-agent gating. In a multi-bot workspace handling engineering, finance, legal, and devops tasks, this increases the risk of unintended agent invocation, cross-role data exposure, and prompt injection or abuse from users in shared Discord channels.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.