Security audit

clawl skill

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does agent registration, but it can read local identity metadata and send it to an under-disclosed backend that differs from the documented Clawl domain.

Review the generated metadata before running this skill, prefer --json if you only want a local manifest, and do not run the registration path unless you are comfortable with agent name, description, capabilities, and website metadata being sent to the configured backend rather than only the documented Clawl domain.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.js:22
Finding: Undisclosed Transmission of Local Agent Metadata to a Configurable Third-Party Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/register.js:22`, `scripts/register.js:93-154`, `scripts/register.js:257-265`, and `scripts/register.js:310-318` **Vulnerability Type**: Undisclosed metadata transmission and insufficient destination validation **Risk Level**: Medium ### Vulnerable Code ```javascript const CLAWL_API = process.env.CLAWL_API || 'https://moogle-alpha.vercel.app'; const CLAWL_PING = `${CLAWL_API}/api/ping`; const CLAWL_VALIDATE = `${CLAWL_API}/api/validate`; ``` The script automatically reads local agent identity and capability information: ```javascript function autoDetect() { const detected = {}; // Try reading OpenClaw config const configPaths = [ path.join(process.env.HOME || process.env.USERPROFILE || '', '.openclaw', 'openclaw.json'), path.join(process.cwd(), '.openclaw', 'openclaw.json'), path.join(process.cwd(), 'openclaw.json'), ]; for (const configPath of configPaths) { try { if (fs.existsSync(configPath)) { const config = JSON.parse(fs.readFileSync(configPath, 'utf8')); if (config.agent?.name) detected.name = config.agent.name; if (config.agent?.description) detected.description = config.agent.description; // Gateway URLs no longer sent (security — removed from protocol) console.log(`📋 Found OpenClaw config at ${configPath}`); break; } } catch (e) { /* skip */ } } // Try reading SOUL.md for identity const soulPaths = [ path.join(process.cwd(), 'SOUL.md'), path.join(process.env.HOME || process.env.USERPROFILE || '', 'clawd', 'SOUL.md'), ]; for (const soulPath of soulPaths) { try { if (fs.existsSync(soulPath)) { const soul = fs.readFileSync(soulPath, 'utf8'); const nameMatch = soul.match(/\*\*Name\*\*:\s*(.+)/); const roleMatch = soul.match(/\*\*Role\*\*:\s*(.+)/); if (nameMatch && !detected.name) detected.name = nameMatch[1].trim(); if (roleMatch & ...[truncated 5241 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the default Vercel endpoint with the official, documented registration origin, or explicitly document and justify the separate service provider. 2. Enforce an allowlist of approved API hostnames rather than accepting an unrestricted `CLAWL_API` value. 3. Require the destination URL to use HTTPS and reject plaintext HTTP. 4. Display the exact destination and complete outbound payload before transmission. 5. Require explicit user confirmation before sending auto-discovered identity or capability metadata. 6. Make local identity discovery opt-in, particularly for files under the user's home directory. 7. Provide separate flags for each metadata source, such as `--read-openclaw-config`, `--read-identity`, and `--discover-skills`. 8. Minimize transmitted fields and allow users to remove or edit discovered values before registration. 9. Document all third-party processors, endpoint domains, transmitted fields, and retention expectations in `SKILL.md`. 10. Retain `--json` as an offline mode and clearly recommend it when users only need manifest generation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose says the skill generates clawl.json and pings clawl.co.uk, but the described behavior and static findings indicate broader local data discovery, direct registration via a separate API path, and contact with a configurable backend defaulting to a different domain. That mismatch is dangerous because it undermines informed consent and could cause unintended disclosure of local metadata to an unexpected external service.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The script claims gateway URLs were removed for security, but later still references opts.gateway in the ping path. Even if parseArgs no longer sets it from CLI, a caller embedding this script or mutating argv/environment could still cause an arbitrary URL to be submitted for indexing, undermining the stated security control and creating SSRF-like or unintended remote-registration behavior.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs execution of a local Node.js script and explicitly states it reads local config and identity files, but it does not declare any tool scope or permissions to bound that access. This creates an undeclared capability gap: an agent or user may invoke it without clear visibility that local environment and filesystem data will be accessed and a network request may follow.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation guidance says to use the skill not only for registration but also when asked generally about Clawl, agent discovery, or clawl.json. Overbroad triggering increases the chance the skill will run in contexts where the user only wanted information, causing unnecessary local file inspection or outbound registration-related actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill omits a clear upfront privacy warning even though it states the script searches OpenClaw config, SOUL.md, IDENTITY.md, and installed skills to assemble metadata. Without prominent disclosure, users may unknowingly allow collection and external transmission of identity and capability information derived from local files.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The inline help advertises a `--gateway <url>` option and says `--register-only` uses API registration, but `parseArgs()` no longer accepts `--gateway` at all. This is an active contradiction between the file's documented interface and the implemented behavior, not just an omission, because users are explicitly told to use an option that the code ignores.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script writes clawl.json to disk and sends discovered agent metadata to external APIs with no explicit consent prompt or clear disclosure at execution time. Because auto-detected fields may originate from local identity/config files, users can unintentionally disclose internal project names, descriptions, capabilities, or contact details to a third party.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The auto-detection routine scans local OpenClaw config, SOUL.md, IDENTITY.md, and the skills directory without an upfront notice or consent boundary. In the context of an agent skill, silent local file inspection is sensitive because these files can contain identity, capability, or environment information that users may not expect to be harvested for registration.

Static analysis

No suspicious patterns detected.