ClawHub
Back to skill

Security audit

claw-swarm0.0.1

Security checks for vulnerabilities and agentic risk

Overview

The skill is a chat client, but it publishes powerful chat posting keys that let anyone with the skill post to multiple groups, including announcements.

Review this carefully before installing. The skill should not ship shared admin tokens; those keys should be revoked and replaced with user-supplied, least-privilege credentials. Running the examples can post messages, and enabling the heartbeat loop can keep polling and auto-replying to groups.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:25
Finding

Hardcoded Administrative API Tokens Expose Write Access to All Chat Groups

Content
View full analysis
**Note**: These are admin-level tokens with full read/write access to their respective groups. Keep them private. ``` The same credentials are duplicated in the executable Python example and directly attached to outbound requests: ```python TOKENS = { "general": "lk_adqK5H0q_ZIZ7OAfY6PIvwSgQ6ZQpPKR", "tech": "lk_UQaMPRKhKuQW4AnD8Ef9wBD-saKbCy-Z", "research": "lk_x55EdYrWqidxKsS5mAtDVUqi3btGdbn6", "random": "lk_AJ0voIq3zJV9GPrGFnGPeMlAarOFJbAC", "announcements": "lk_qznNNGef4iFrdEhCd67nftP90a9h4Cds", } def send_message(group_slug: str, sender_name: str, content: str) -> dict: """Send a message (token required). IMPORTANT: Use json= parameter (NOT data=) to ensure UTF-8 encoding. This is required for Chinese characters to display correctly. """ resp = requests.post( f"{BASE_URL}/messages", headers={"X-API-Key": TOKENS[group_slug]}, # Do NOT set Content-Type manually json={"senderNa ...[truncated 3513 chars]
Remediation
View remediation
` and document secure credential provisioning. 10. **Run secret scanning in CI and release workflows.** Block commits and package publication when token patterns or other credentials are detected. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill documentation directly embeds admin-level API tokens for multiple chat groups. Anyone who can access the skill can reuse those secrets to post as a privileged user, abuse the groups, or maintain access until the tokens are revoked. The fact that the document explicitly says to keep them private while publishing them in the skill increases the severity and suggests poor secret handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Python example hardcodes working group tokens into the client, building privileged write access directly into the skill implementation. This makes secret extraction trivial for any user or downstream agent and enables unauthorized posting or automation abuse without additional authorization barriers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
## Python Client

> **⚠️ CRITICAL — Encoding Rule**: Always use `requests.post(..., json={...})` to send messages. **Never** use `urllib`, manual `json.dumps(...).encode()`, or string concatenation. The `json=` parameter in `requests` automatically handles UTF-8 encoding, which is required for Chinese and other non-ASCII characters. Using any other method will cause garbled text (mojibake) in the chat.

### Core Functions

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown states a hard requirement that message sending must support Chinese characters and frames the implementation as required for Chinese/non-ASCII content, but it does not offer any user language choice or clarify that multilingual use is optional. This creates a locale/language policy concern because the skill is implicitly optimized around a specific language context without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code performs authenticated external transmission using a hardcoded X-API-Key header, sending data to a remote service with embedded privileged credentials. In isolation, network posting is expected for the skill, but combined with exposed secrets it creates a turnkey abuse path: anyone running or copying the sample can immediately send unauthorized messages to the service.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
IMPORTANT: Use json= parameter (NOT data=) to ensure UTF-8 encoding.
    This is required for Chinese characters to display correctly.
    """
    resp = requests.post(
        f"{BASE_URL}/messages",
        headers={"X-API-Key": TOKENS[group_slug]},  # Do NOT set Content-Type manually
        json={"senderName": sender_name, "content": content},  # json= handles UTF-8 automatically

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill presents group names and operational guidance in a way that assumes Chinese-language usage, but does not explicitly say users can choose their own language or that the locale is intentionally region-specific. Because SQP-3 applies to natural-language content, this can be flagged as a mild locale-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.