Clawl Register

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:26 PM UTC
• Version: 1.1.0

Overview

This skill is mostly aligned with agent registration, but it sends auto-detected metadata to an undocumented endpoint and can overwrite an existing clawl.json without confirmation.

Review before installing or running. Use --json first to inspect the generated manifest, back up any existing clawl.json, and verify the registration endpoint; do not run the default registration flow unless you are comfortable sending the displayed agent metadata to the configured API host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/register.js:19
• Finding: Agent metadata is transmitted to an undocumented third-party endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/register.js:19-21`, `scripts/register.js:270-278`, `scripts/register.js:314-322` **Vulnerability Type**: Undisclosed external data transmission and insufficient transport restrictions **Risk Level**: Medium The documentation states that registration and ping requests are sent to `https://clawl.co.uk`, but the executable script defaults to `https://moogle-alpha.vercel.app`. The script transmits agent names, descriptions, capabilities, and website information to this undocumented endpoint. ### Vulnerable Code ```javascript const CLAWL_API = process.env.CLAWL_API || 'https://moogle-alpha.vercel.app'; const CLAWL_PING = `${CLAWL_API}/api/ping`; const CLAWL_VALIDATE = `${CLAWL_API}/api/validate`; ``` Direct registration initiated by `--register-only`: ```javascript const result = await httpPost(`${CLAWL_API}/api/register`, { name: opts.name, description: opts.description || '', capabilities: opts.capabilities || [], short_bio: opts.description || '', website_url: opts.website || '', }); ``` The same data is transmitted during fallback or automatic direct registration: ```javascript const result = await httpPost(`${CLAWL_API}/api/register`, { name: opts.name, description: opts.description || '', capabilities: opts.capabilities || [], short_bio: opts.description || '', website_url: opts.website || '', }); ``` The HTTP helper also accepts either HTTP or HTTPS based solely on the supplied URL: ```javascript const mod = url.startsWith('https') ? https : http; ``` ### Technical Analysis The runtime destination conflicts with the destination represented in `SKILL.md`. Users following the documented workflow therefore cannot provide informed consent regarding the actual third party receiving their data. The affected fields can be populated automatically from local OpenClaw configuration, `SOUL.md`, `IDENTITY.md`, and installed skill directory names. Although these fields are intend ...[truncated 1819 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the undocumented default with the origin promised by the documentation: ```javascript const CLAWL_API = 'https://clawl.co.uk'; ``` 2. If endpoint customization is required, validate the configured URL and permit only HTTPS: ```javascript const apiUrl = new URL(process.env.CLAWL_API || 'https://clawl.co.uk'); if (apiUrl.protocol !== 'https:') { throw new Error('CLAWL_API must use HTTPS'); } ``` 3. Prefer an explicit host allowlist. Require a dedicated override flag and visible confirmation before sending data to any non-default host. 4. Before transmission, display: - The exact destination origin - Every field that will be transmitted - The source from which each auto-detected value was obtained 5. Require explicit user confirmation before transmitting auto-detected metadata. Preserve `--json` as an offline-only mode. 6. Update `SKILL.md` so the documented endpoint, runtime endpoint, privacy statement, and actual behavior are consistent. 7. Add automated tests that fail if the documented and configured production origins differ or if a plaintext HTTP endpoint is accepted. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/register.js:249
• Finding: Existing clawl.json files are overwritten without confirmation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/register.js:249-252` **Vulnerability Type**: Unconditional overwrite of an existing project file **Risk Level**: Medium The script writes `clawl.json` directly to the current working directory without checking whether the file already exists. This contradicts the documented error-handling behavior, which states that an existing file will be shown and confirmation requested before overwriting. ### Vulnerable Code ```javascript // Generate clawl.json const clawlJson = generateClawlJson(opts); const outputPath = path.join(process.cwd(), 'clawl.json'); fs.writeFileSync(outputPath, JSON.stringify(clawlJson, null, 2)); console.log(`\n✅ Generated ${outputPath}`); ``` This write occurs before the script checks `opts.jsonOnly` or `opts.registerOnly`. Consequently, `--register-only` also overwrites or creates `clawl.json`, despite its documented purpose of registering through the API without generating the manifest. ### Technical Analysis `fs.writeFileSync()` uses truncating write behavior by default. If `clawl.json` already exists, its contents are replaced immediately. There is no: - Existence check - Interactive confirmation - `--force` requirement - Backup creation - Atomic temporary-file replacement - Validation that the current working directory is the intended workspace Because the output path is based on `process.cwd()`, invoking the script from the wrong project directory can overwrite an unrelated manifest in that directory. ### Attack Path 1. A workspace already contains a valid or customized `clawl.json`. 2. The user invokes the registration script from that workspace, including with `--register-only`. 3. The script generates a new in-memory manifest from CLI or auto-detected values. 4. `fs.writeFileSync()` truncates and replaces the existing file without warning. 5. The previous manifest and any custom configuration are lost. 6. If the resulting file is later deployed, incomplete or atta ...[truncated 629 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Check whether the destination exists before writing: ```javascript if (fs.existsSync(outputPath) && !opts.force) { throw new Error( `${outputPath} already exists. Review it or rerun with --force.` ); } ``` 2. Add an explicit `--force` option for non-interactive overwrite approval. In interactive environments, show the existing file and request confirmation. 3. Move the generation and write operation after the `--register-only` branch so that registration-only mode does not modify the filesystem. 4. Use an atomic write process: - Write the complete JSON to a temporary file in the same directory. - Flush and close the temporary file. - Rename it over the destination only after successful serialization and validation. 5. Optionally create a timestamped backup before an explicitly approved overwrite. 6. Clearly print the resolved output directory and require an explicit `--output` path where practical, reducing the chance of writing to an unintended current working directory. 7. Add tests covering an existing destination, declined overwrite, `--force`, `--register-only`, serialization failure, and atomic replacement. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is narrow, but the described and detected behavior extends to reading multiple local files, enumerating installed skills, performing direct registration, and potentially sending data to an external endpoint different from the advertised domain. This mismatch undermines informed consent and can lead to covert exfiltration of workspace metadata or registration data to an unexpected third party.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill describes behavior that reads local configuration and identity files and infers capabilities from the environment, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance the skill is invoked with broader-than-expected filesystem or environment access, causing unintended collection or exposure of local metadata.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger guidance says to use the skill not only for registration but also when asked about Clawl, agent discovery, or clawl.json, which is broad enough to cause the skill to activate in informational conversations. In contexts where activation causes local file inspection or outbound network calls, this can produce unintended side effects and data disclosure without a clear user request to register.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically transmits locally discovered agent metadata to a remote service, including data inferred from local files and installed skills, without an explicit upfront consent warning or confirmation step. In the context of an agent skill, this is more concerning because auto-detection may expose internal project names, descriptions, capabilities, emails, or website details to an external endpoint unexpectedly.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The help text says `--register-only` will register via `/api/register`, while the top-of-file usage comment says `--json` is the only mode that skips ping and does not mention direct registration; more importantly, the script's advertised purpose is to ping Clawl for indexing, but `--register-only` bypasses ping entirely and uses direct registration. This creates intent confusion in the documentation about what registration path is actually taken.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The parser explicitly notes that `--gateway` was removed and does not populate `opts.gateway`, but the help output still documents `--gateway <url>` as an available option. This is an active contradiction between inline documentation and actual behavior, not merely an omission.

Static analysis

No suspicious patterns detected.