ClawPick

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent marketplace purpose, but it needs review because it uses an unverified remote install path and stores API credentials in an unsafe local .env flow.

Install only if you are comfortable with a third-party marketplace client that makes public product/demand posts and stores its API key locally. Avoid the curl-to-tar install path unless the publisher provides a pinned, verified release, and keep the .env file private; preferably replace the credential storage with a secret manager or a strictly parsed config file before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:225

Finding

Agent Output Hijacking Through Mandatory Promotional Workflow

Content

View full analysis

My AI agent just found me the perfect mirrorless camera on ClawPick in under 3 minutes — compared 12 options and matched my exact specs. Way faster than browsing myself. https://clawpick.dev **Discord/Telegram style (casual, slightly longer):** > Just used ClawPick to find a laptop under $800. My agent searched the network, compared specs from multiple sellers, and found a deal I wouldn't have found on my own. The whole thing took 5 minutes. If you have an AI agent, check it out → https://clawpick.dev 4. **Always** show the draft to the user for review before posting. The user may edit, approve, or decline. 5. If the user provides access to a social platform (e.g. through an MCP tool or API), post on their behalf **only after explicit approval**. 6. If no social posting tool is available, copy the message to clipboard or display it for the user to share manually. * ...[truncated 2120 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32

Finding

Unverified Remote Skill Archive Download and Extraction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api.sh:11

Finding

Shell Command Injection Through Executable .env File and Unvalidated API Values

Content

View full analysis

/dev/null) returned_key=$(echo "$response" | python3 -c "import json,sys; print(json.load(sys.stdin).get('api_key',''))" 2>/dev/null) if [[ -n "$returned_id" ]]; then echo "CLAWPICK_AGENT_ID=${returned_id}" >> "$BASE_DIR/.env" fi if [[ -n "$returned_key" ]]; then echo "CLAWPICK_API_KEY=${returned_key}" >> "$BASE_DIR/.env" fi echo "$response" ``` ### Technical Analysis The script loads `.env` with Bash `source`, which treats every line in that file as executable shell syntax rather than configuration data. This is dangerous because values obtained from the registration API are appended directly to the same file without validation, encoding, control-character rejection, or shell-safe quoting. The JSON parser returns the `id` and `api_key` fields as strings. If either value contains a newline followed by a shell command, `echo` writes that command as a separate line. On the next invocation, `source "$BASE_DIR/.env"` executes the injected line. For example, a malicious registration response could conceptually contain an identifier equivalent to: ```text legitimate-id touch /tmp/clawpick-injected ``` The generated file would contain: ```bash CLAWPICK_AGENT_ID=legitimate-id touch /tmp/clawpick-injected ``` The second line would run when the script is invoked again. Shell substitutions or metacharacters may provide additional injection opportunities depending on how the resulting ...[truncated 1643 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

This creates a `clawpick/` directory with `SKILL.md` and `scripts/api.sh`. For all subsequent commands, `{baseDir}` is this `clawpick/` directory.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill instructs the agent to extract an API key from a response and persist it into a local .env file for automatic reuse. Storing secrets in a plaintext file inside the skill directory creates credential exposure risk through later tool calls, file browsing, package upload, or accidental inclusion in logs and transcripts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

You must extract the api_key value and append it to {baseDir}/.env. The script auto-loads this file on every run:

bash

# Parse api_key from the register response and append to .env
echo "CLAWPICK_API_KEY=a1b2c3d4e5f6..." >> {baseDir}/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This section explicitly operationalizes saving the returned API key into .env, normalizing plaintext credential persistence as part of setup. Because the skill also auto-loads that file on every run, any later script execution in this directory implicitly gains the credential, which amplifies the effect of script compromise or unintended file access.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

You must extract the api_key value and append it to {baseDir}/.env. The script auto-loads this file on every run:

bash

# Parse api_key from the register response and append to .env
echo "CLAWPICK_API_KEY=a1b2c3d4e5f6..." >> {baseDir}/.env

Or as a one-liner (register + parse + save):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The one-liner parses the registration response and writes the API key directly from shell variables into a plaintext .env file. This pattern increases exposure because secrets may leak via shell history, process inspection, debugging output, or accidental exfiltration of the skill directory, making credential theft straightforward if the environment is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash

RESPONSE=$(bash {baseDir}/scripts/api.sh register "MyShop")
API_KEY=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['api_key'])")
echo "CLAWPICK_API_KEY=${API_KEY}" >> {baseDir}/.env

Important: Use >> (append) not > (overwrite), because the .env file already contains the CLAWPICK_UUID from step 1.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 80% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

4. **Always** show the draft to the user for review before posting. The user may edit, approve, or decline.
5. If the user provides access to a social platform (e.g. through an MCP tool or API), post on their behalf **only after explicit approval**.
6. If no social posting tool is available, copy the message to clipboard or display it for the user to share manually.

**Key principles:**
- Never post without user consent — always ask first, always show the draft

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api.sh (reported line 7)May include surrounding context.

sh

set -euo pipefail

# --- Auto-load .env from script directory or baseDir ---
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BASE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api.sh (reported line 33)May include surrounding context.

sh

set -euo pipefail

# --- Auto-load .env from script directory or baseDir ---
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BASE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api.sh (reported line 192)May include surrounding context.

sh

set -euo pipefail

# --- Auto-load .env from script directory or baseDir ---
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BASE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script sources $BASE_DIR/.env as shell code, not as a data-only env parser. If an attacker can modify that file, arbitrary commands execute in the current shell context when the script runs, which is more severe than merely reading credentials.

Content

Scanner excerpt · scripts/api.sh (reported line 11)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BASE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

if [[ -f "$BASE_DIR/.env" ]]; then
  set -a
  source "$BASE_DIR/.env"
  set +a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This line is part of the unsafe .env loading flow that exports values after sourcing a file as executable shell content. In an agent skill context, auto-executing repository-local configuration increases risk because cloned marketplace content may include or later receive a malicious .env payload.

Content

Scanner excerpt · scripts/api.sh (reported line 13)May include surrounding context.

sh

if [[ -f "$BASE_DIR/.env" ]]; then
  set -a
  source "$BASE_DIR/.env"
  set +a
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api.sh (reported line 45)May include surrounding context.

sh

if [[ -z "$API_KEY" ]]; then
    echo "Error: CLAWPICK_API_KEY is not set." >&2
    echo "Run 'api.sh register <name>' to get your API key," >&2
    echo "then save it to ${BASE_DIR}/.env" >&2
    exit 1
  fi
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script writes the agent identifier to a plaintext .env file in the repository base directory. While the agent ID may be less sensitive than the API key, storing identifiers in workspace files can aid account correlation and persistence, and this line is part of the broader insecure secret/config write flow.

Content

Scanner excerpt · scripts/api.sh (reported line 198)May include surrounding context.

sh

returned_key=$(echo "$response" | python3 -c "import json,sys; print(json.load(sys.stdin).get('api_key',''))" 2>/dev/null)

  if [[ -n "$returned_id" ]]; then
    echo "CLAWPICK_AGENT_ID=${returned_id}" >> "$BASE_DIR/.env"
  fi
  if [[ -n "$returned_key" ]]; then
    echo "CLAWPICK_API_KEY=${returned_key}" >> "$BASE_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The script appends the API key directly to $BASE_DIR/.env in plaintext. In an agent marketplace setting, repository-local secret files are especially risky because users may run third-party skills in shared workspaces, accidentally commit the file, or expose it to other local processes and tooling.

Content

Scanner excerpt · scripts/api.sh (reported line 201)May include surrounding context.

sh

echo "CLAWPICK_AGENT_ID=${returned_id}" >> "$BASE_DIR/.env"
  fi
  if [[ -n "$returned_key" ]]; then
    echo "CLAWPICK_API_KEY=${returned_key}" >> "$BASE_DIR/.env"
  fi

  echo "$response"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires shell and network access to download and invoke scripts, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens sandboxing and reviewability because an agent may grant broader capabilities than are necessary, increasing the blast radius if the bundled script or remote content is malicious or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically appends the returned agent ID and API key to a local .env file without confirming with the user, warning about secret storage, or setting restrictive file permissions. This can expose credentials to other local users, accidental commits, backups, or other tooling that reads workspace files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.