Clawl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:29 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what a registration helper would do, but it sends agent metadata to an undocumented default service and overwrites local manifest files without the promised confirmation.

Review before installing or running. Use --json if you only want a local manifest, back up any existing clawl.json first, and do not run the registration path unless you are comfortable sending agent profile metadata to the script's configured API endpoint rather than only the documented clawl.co.uk service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/register.js:18

Finding

Agent metadata is transmitted to an undocumented third-party endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/register.js:18-20, scripts/register.js:267-275, and scripts/register.js:303-312
Vulnerability Type: Undisclosed external data transmission
Risk Level: Medium

The documentation states that the script registers agents with clawl.co.uk, but the executable code defaults to https://moogle-alpha.vercel.app. The script automatically sends agent metadata derived from command-line arguments and local files to this different service.

Vulnerable Code

js

const CLAWL_API = process.env.CLAWL_API || 'https://moogle-alpha.vercel.app';
const CLAWL_PING = `${CLAWL_API}/api/ping`;
const CLAWL_VALIDATE = `${CLAWL_API}/api/validate`;

js

const result = await httpPost(`${CLAWL_API}/api/register`, {
  name: opts.name,
  description: opts.description || '',
  capabilities: opts.capabilities || [],
  short_bio: opts.description || '',
  website_url: opts.website || '',
});

The same registration payload is also transmitted by the registerDirect function:

js

const result = await httpPost(`${CLAWL_API}/api/register`, {
  name: opts.name,
  description: opts.description || '',
  capabilities: opts.capabilities || [],
  short_bio: opts.description || '',
  website_url: opts.website || '',
});

Technical Analysis

The script reads identity information from OpenClaw configuration files, SOUL.md, and IDENTITY.md, and derives capabilities from locally installed skill-directory names. Unless --json is supplied, it transmits some of that derived information to the configured registration API.

The default API hostname materially differs from the service named in SKILL.md. Consequently, a user following the documented registration workflow may reasonably believe that information is being sent directly to clawl.co.uk, while the actual recipient is a Vercel-hosted application. No confirmation prompt displays the complete de ...[truncated 1560 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default API to the official, documented https://clawl.co.uk endpoint after verifying its ownership and expected API paths.
2. Ensure SKILL.md, command help, runtime messages, and executable configuration all identify the same destination.
3. Before the first network request, display the exact hostname and complete redacted payload and require explicit user confirmation.
4. Make local manifest generation the default behavior and require an explicit --register option for transmission.
5. If alternate endpoints are required, clearly document the override and restrict it to a trusted hostname allowlist.
6. Add automated tests that verify the default destination and fail when documentation and implementation diverge.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/register.js:203

Finding

Registration metadata can be transmitted over plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/register.js:18 and scripts/register.js:203-231
Vulnerability Type: Insecure transport configuration
Risk Level: Low

The CLAWL_API environment variable can specify an arbitrary http:// endpoint. The HTTP helper deliberately selects the plaintext HTTP client whenever the URL does not begin with https.

Vulnerable Code

js

const CLAWL_API = process.env.CLAWL_API || 'https://moogle-alpha.vercel.app';

js

function httpPost(url, data) {
  return new Promise((resolve, reject) => {
    const payload = JSON.stringify(data);
    const mod = url.startsWith('https') ? https : http;
    const parsed = new URL(url);
    
    const req = mod.request({
      hostname: parsed.hostname,
      port: parsed.port,
      path: parsed.pathname,
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Content-Length': Buffer.byteLength(payload),
        'User-Agent': 'ClawlRegister/1.0'
      },
      timeout: 15000
    }, (res) => {
      let body = '';
      res.on('data', chunk => body += chunk);
      res.on('end', () => {
        try {
          resolve({ status: res.statusCode, data: JSON.parse(body) });
        } catch (e) {
          resolve({ status: res.statusCode, data: body });
        }
      });
    });
    
    req.on('error', reject);
    req.on('timeout', () => { req.destroy(); reject(new Error('Request timeout')); });
    req.write(payload);
    req.end();
  });
}

Technical Analysis

The protocol is not validated after parsing the URL. If CLAWL_API begins with http://, registration and ping requests are sent without TLS. This removes server authentication, transport confidentiality, and transport integrity.

Exploitation requires influence over the process environment or configuration used to launch the script, or a user intentionally selectin ...[truncated 1229 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the URL first and require parsed.protocol === 'https:'.
2. Reject http:, non-HTTP schemes, malformed URLs, embedded credentials, and unexpected ports.
3. Consider allowlisting official registration hostnames rather than permitting arbitrary endpoints.
4. If plaintext HTTP is required for local development, permit it only for loopback addresses behind an explicit development-only option.
5. Log the validated destination before sending data and obtain confirmation for non-default hosts.
6. Add tests proving that http://, protocol-relative, and unsupported-scheme URLs are rejected.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/register.js:257

Finding

Existing clawl.json files are overwritten without warning or confirmation

Content

View full analysis

Vulnerability Details

File Location: scripts/register.js:257-260
Vulnerability Type: Unsafe file overwrite
Risk Level: Low

The script writes directly to clawl.json in the current working directory without checking whether the file already exists. This contradicts the documented error-handling behavior, which states that an existing file will be shown and confirmation requested before overwrite.

Vulnerable Code

js

// Generate clawl.json
const clawlJson = generateClawlJson(opts);
const outputPath = path.join(process.cwd(), 'clawl.json');
fs.writeFileSync(outputPath, JSON.stringify(clawlJson, null, 2));
console.log(`\n✅ Generated ${outputPath}`);

Technical Analysis

fs.writeFileSync uses overwrite semantics when the target already exists. There is no existence check, interactive confirmation, backup, exclusive-creation flag, or explicit --force requirement.

This creates a local data-integrity issue. Running the documented command in a workspace containing a customized or production clawl.json silently destroys the previous content. The effect also occurs in --register-only mode because file generation happens before the registration-mode branch.

The target filename itself is fixed and based on process.cwd(), so direct arbitrary-path injection is not present. The principal risk is unintended replacement of an existing manifest.

Attack Path

1. A project contains an existing clawl.json with customized or production metadata.
2. A user runs the registration script from that project directory.
3. The script generates a new manifest from auto-detected or command-line values.
4. fs.writeFileSync truncates and replaces the existing file without prompting.
5. The original manifest and any custom fields are lost.
6. If the changed file is subsequently deployed, the project's published agent metadata may be unintentionally altered.

Impact Assessment

The vulnerab ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

1. Check fs.existsSync(outputPath) before writing.
2. Refuse to overwrite by default and require an explicit --force option in non-interactive environments.
3. In interactive use, display a diff or the proposed manifest and request confirmation.
4. Create a timestamped backup before replacing an existing manifest.
5. Write to a temporary file in the same directory and atomically rename it after successful serialization and validation.
6. Ensure --register-only does not generate or modify clawl.json, matching the documented behavior.
7. Add regression tests covering existing files, declined confirmation, --force, and --register-only.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose says the skill generates a discovery file and pings Clawl, but the described behavior goes further by harvesting local identity/configuration files, enumerating installed skills, and performing direct registration to an endpoint that may differ from clawl.co.uk. This mismatch is dangerous because it can mislead users and calling agents about the extent of collection and exfiltration, causing unreviewed local metadata disclosure to an unexpected third party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill instructs execution of a local Node.js script and describes behavior that reads environment-adjacent local files and performs outbound network registration, but it declares no explicit tool scope or permissions. This creates a transparency and containment problem: an agent or user may invoke it without clear authorization boundaries, increasing the risk of unintended local data access and external disclosure of metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is broad enough to activate not only for explicit registration requests but also for general questions about Clawl or agent discovery. That increases the chance the skill runs in contexts where the user only wanted information, potentially causing unintended file generation, local inspection, or network calls without informed intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script’s comments and help text state that gateway URLs were removed for security, yet the main logic still accepts and uses opts.gateway as a ping target. This inconsistency can mislead users and reviewers into believing an unsafe input path was eliminated when it remains reachable, enabling unintended registration or server-side fetching of attacker-controlled URLs if gateway is set programmatically or via unexpected argument handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script auto-detects data from local files such as OpenClaw config, SOUL.md, IDENTITY.md, and installed skill names, then may transmit derived metadata to a remote API without explicit, informed consent about exactly what will be sent. In an agent-skill context, this is more dangerous because the skill runs in a potentially sensitive workspace and can exfiltrate project or identity metadata to an external service by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script unconditionally writes to clawl.json in the current working directory, which can overwrite an existing file. Although it logs after the write succeeds, there is no prior confirmation, overwrite warning, or comment/docstring disclosing this file-modifying behavior at the point of execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.