Security audit

Clawl Register

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with agent registration, but it sends auto-detected metadata to an undocumented endpoint and can overwrite an existing clawl.json without confirmation.

Review before installing or running. Use --json first to inspect the generated manifest, back up any existing clawl.json, and verify the registration endpoint; do not run the default registration flow unless you are comfortable sending the displayed agent metadata to the configured API host.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.js:19
Finding: Agent metadata is transmitted to an undocumented third-party endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.js:249
Finding: Existing clawl.json files are overwritten without confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is narrow, but the described and detected behavior extends to reading multiple local files, enumerating installed skills, performing direct registration, and potentially sending data to an external endpoint different from the advertised domain. This mismatch undermines informed consent and can lead to covert exfiltration of workspace metadata or registration data to an unexpected third party.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill describes behavior that reads local configuration and identity files and infers capabilities from the environment, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance the skill is invoked with broader-than-expected filesystem or environment access, causing unintended collection or exposure of local metadata.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger guidance says to use the skill not only for registration but also when asked about Clawl, agent discovery, or clawl.json, which is broad enough to cause the skill to activate in informational conversations. In contexts where activation causes local file inspection or outbound network calls, this can produce unintended side effects and data disclosure without a clear user request to register.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script automatically transmits locally discovered agent metadata to a remote service, including data inferred from local files and installed skills, without an explicit upfront consent warning or confirmation step. In the context of an agent skill, this is more concerning because auto-detection may expose internal project names, descriptions, capabilities, emails, or website details to an external endpoint unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text says --register-only will register via /api/register, while the top-of-file usage comment says --json is the only mode that skips ping and does not mention direct registration; more importantly, the script's advertised purpose is to ping Clawl for indexing, but --register-only bypasses ping entirely and uses direct registration. This creates intent confusion in the documentation about what registration path is actually taken.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The parser explicitly notes that --gateway was removed and does not populate opts.gateway, but the help output still documents --gateway <url> as an available option. This is an active contradiction between inline documentation and actual behavior, not merely an omission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.