T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/register.js:22- Finding
Undisclosed Transmission of Local Agent Metadata to a Configurable Third-Party Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
clawl skill
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does agent registration, but it can read local identity metadata and send it to an under-disclosed backend that differs from the documented Clawl domain.
Review the generated metadata before running this skill, prefer --json if you only want a local manifest, and do not run the registration path unless you are comfortable with agent name, description, capabilities, and website metadata being sent to the configured backend rather than only the documented Clawl domain.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented purpose says the skill generates clawl.json and pings clawl.co.uk, but the described behavior and static findings indicate broader local data discovery, direct registration via a separate API path, and contact with a configurable backend defaulting to a different domain. That mismatch is dangerous because it undermines informed consent and could cause unintended disclosure of local metadata to an unexpected external service.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script claims gateway URLs were removed for security, but later still references opts.gateway in the ping path. Even if parseArgs no longer sets it from CLI, a caller embedding this script or mutating argv/environment could still cause an arbitrary URL to be submitted for indexing, undermining the stated security control and creating SSRF-like or unintended remote-registration behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs execution of a local Node.js script and explicitly states it reads local config and identity files, but it does not declare any tool scope or permissions to bound that access. This creates an undeclared capability gap: an agent or user may invoke it without clear visibility that local environment and filesystem data will be accessed and a network request may follow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance says to use the skill not only for registration but also when asked generally about Clawl, agent discovery, or clawl.json. Overbroad triggering increases the chance the skill will run in contexts where the user only wanted information, causing unnecessary local file inspection or outbound registration-related actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill omits a clear upfront privacy warning even though it states the script searches OpenClaw config, SOUL.md, IDENTITY.md, and installed skills to assemble metadata. Without prominent disclosure, users may unknowingly allow collection and external transmission of identity and capability information derived from local files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline help advertises a
--gateway <url>option and says--register-onlyuses API registration, butparseArgs()no longer accepts--gatewayat all. This is an active contradiction between the file's documented interface and the implemented behavior, not just an omission, because users are explicitly told to use an option that the code ignores.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script writes clawl.json to disk and sends discovered agent metadata to external APIs with no explicit consent prompt or clear disclosure at execution time. Because auto-detected fields may originate from local identity/config files, users can unintentionally disclose internal project names, descriptions, capabilities, or contact details to a third party.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The auto-detection routine scans local OpenClaw config, SOUL.md, IDENTITY.md, and the skills directory without an upfront notice or consent boundary. In the context of an agent skill, silent local file inspection is sensitive because these files can contain identity, capability, or environment information that users may not expect to be harvested for registration.
- Content
Static analysis
No suspicious patterns detected.