ClawPaw Phone Control

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:02 PM UTC
• Version: 1.0.0

Overview

This appears to be a real ClawPaw phone setup/control package, but it grants powerful Android access and handles phone-control credentials and screenshots in risky ways.

Install only if you intend to give ClawPaw broad remote control over an Android phone. Before use, remove curl -k/--insecure, avoid putting the secret in shell history, review the backend trust model, disable TCP ADB when finished, and be careful with screenshots, location, notification, microphone/camera, keyboard, and real-world action workflows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/reconnect-adb.sh:15

Finding

TLS Certificate Verification Disabled on the Device-Control Channel

Content

View full analysis

" \ -d '{"uid":"","key":"home"}' curl -sk -X POST https://www.clawpaw.me/api/adb/screenshot \ -H "Content-Type: application/json" \ -H "x-clawpaw-secret: " \ -d '{"uid":""}' ``` ### Technical Analysis The `-k`/`--insecure` curl option disables TLS certificate and hostname verification. Encryption alone is insufficient when the server identity is not authenticated: a machine-in-the-middle can present an arbitrary certificate and terminate the connection. These requests carry the reusable `x-clawpaw-secret` credential and invoke high-impact phone-control operations, including establishing the ADB connection, pressing device keys, and retrieving screenshots. Consequently, this is not merely a confidentiality weakness; it compromises the authentication and integrity of the remote device-control channel. ### Attack Path 1. An attacker obtains a network interception position, such as through a malicious Wi-Fi access point, compromised proxy, DNS manipulation, or routing attack. 2. The attacker redirects or intercepts traffic int ...[truncated 1176 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/reconnect-adb.sh:3

Finding

Reusable Phone-Control Secret Exposed Through Command Arguments and Plaintext Configuration

Content

View full analysis

UID="$1" SECRET="$2" BACKEND="https://www.clawpaw.me" if [ -z "$UID" ] || [ -z "$SECRET" ]; then echo "Usage: $0 " exit 1 fi ``` The setup instructions explicitly direct users to place the secret on the command line: ```bash bash .claude/skills/clawpaw-setup/scripts/reconnect-adb.sh ``` They also direct users to store it in Claude configuration: ```json "clawpaw": { "type": "stdio", "command": "node", "args": ["/mcp/dist/index.js"], "env": { "CLAWPAW_BACKEND_URL": "https://www.clawpaw.me", "CLAWPAW_UID": "", "CLAWPAW_SECRET": "" } } ``` ### Technical Analysis Command-line arguments may be retained in shell history and can be visible through process inspection while a process is running. They may also be captured by terminal logging, support transcripts, command auditing, or diagnostic tooling. The optional MCP setup stores the reusable secret directly in `~/.claude.json`. Although local file permissions may limit access, the project provides no instruction to enforce restrictive permissions, use an operating-system credential store, redact backups, or rotate the secret. Configuration files are also frequently copied into support bundles or synchronized across systems. Because this credential authenticates remote phone-control operations, its security sensitivity is substantially higher than an ordinary application preference. ### Attack Path 1. The user follows the documented reconnect command and enters the secret directly into a shell. 2. The command is retained in shell history or observed through proc ...[truncated 1115 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/grant-permissions.sh:24

Finding

Excessive Android Privileges and Persistent TCP ADB Exposure

Content

View full analysis

/dev/null && echo "OK" || echo "FAILED" echo -n "[2/3] WRITE_SECURE_SETTINGS (auto-enable accessibility)... " "$ADB" shell pm grant $PKG android.permission.WRITE_SECURE_SETTINGS 2>/dev/null && echo "OK" || echo "FAILED" echo -n "[3/3] adb tcpip 5555 (enable wireless ADB)... " "$ADB" tcpip 5555 2>/dev/null && echo "OK" || echo "FAILED" ``` The setup guide describes the grants as part of the normal installation flow: ```text This grants 3 permissions: - WRITE_SETTINGS — brightness control - WRITE_SECURE_SETTINGS — auto-enable accessibility service - adb tcpip 5555 — enable wireless ADB over SSH tunnel ``` ### Technical Analysis `WRITE_SECURE_SETTINGS` is a privileged Android permission unavailable to ordinary applications. It allows modification of security-sensitive system settings and is used here to automate accessibility-service activation. Accessibility access can observe screen content and perform UI actions across applications, making it a high-impact control boundary. The script also switches ADB into TCP mode on port 5555. ADB provides broad debugging authority, including shell execution and application interaction. Moving it from a USB-only workflow to a network listener expands the reachable attack surface. Although the declared architecture uses an SSH reverse tunnel, the script does not verify binding scope, firewall restrictions, authentication state, tunnel destination, or whether TCP ADB is disabled after use. `WRITE_SETTINGS` is plausibly connected to brightness control, but automatically granting all three capabilities as a single setup step prevents capability-specific least-privilege ...[truncated 1673 chars]

Remediation

View remediation

/dev/null`, and stop if the resulting state is unsafe or ambiguous. 11. Document how users can audit and revoke `WRITE_SETTINGS`, `WRITE_SECURE_SETTINGS`, accessibility access, USB debugging authorization, and TCP ADB. ]]>

T08 · Insecure Dependencies

Error

• Location: usecase-example/adb-keyboard/SKILL.md:35

Finding

Unverified Third-Party Keyboard APK Is Downloaded, Installed, and Activated

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Step 6 — End-to-End Verification

Run these curl commands with the user's credentials to confirm the full chain works:

bash

# 1. Press home button

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises sensitive operations such as GPS access, camera photos, audio recording, screenshots, SMS-related flows, and device setting changes without embedding user-consent, privacy, or safety warnings. Because this is a phone-control skill, omission of consent and impact guidance materially increases the risk of covert surveillance, data exposure, unwanted communications, or disruptive device changes.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · usecase-example/adb-keyboard/SKILL.md (reported line 47)May include surrounding context.

pm install /data/local/tmp/ADBKeyboard.apk

Clean up

rm /data/local/tmp/ADBKeyboard.apk

text

If `curl` is not available on the device, try `wget`:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is for automating Feishu attendance check-in, but the surrounding skill metadata describes a ClawPaw Android setup helper. This mismatch is dangerous because it can cause the wrong skill to be invoked in a sensitive context, leading to unintended actions on a user's phone, including modification of attendance records.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file’s manifest and body describe a place-registration skill, while the declared skill metadata says this should guide Android APK installation and SSH-tunnel setup. This mismatch can cause the wrong capability to be invoked in a security-sensitive setup flow, leading users or downstream agents to disclose precise location data or execute unrelated actions under false expectations. The context makes this more dangerous because ClawPaw setup is a high-trust workflow involving device control, so incorrect routing or deceptive skill labeling increases the chance of unsafe automation and privacy harm.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands and scripts (bash, adb, curl, Gradle) while declaring no explicit tool scope or allowed-tools boundary. That omission weakens least-privilege protections and makes it easier for a caller or future edit to execute broader host-side actions than users may expect from a setup guide.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill directs the operator to send the user's UID and secret to https://www.clawpaw.me to remotely issue device-control actions and retrieve screenshots. Even if this is the intended product flow, it is still an external transmission of sensitive credentials and device data, creating meaningful risk if the backend is compromised, the credentials leak, or the user does not understand the data path.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Step 6 — End-to-End Verification

Run these curl commands with the user's credentials to confirm the full chain works:

bash

# 1. Press home button

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs retrieval of a live phone screenshot from a remote service and writes it to /tmp/phone_screen.png, then tells the operator to read and display it, but does not require an explicit privacy warning or fresh user consent at that moment. Screenshots can expose highly sensitive content such as messages, authentication codes, banking apps, or health data, so collecting and locally storing them without clear disclosure increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description authorizes the skill for essentially any phone action ('do something on the phone'), creating an overly broad trigger that could cause an agent to invoke high-impact device-control capabilities for ambiguous or low-trust requests. In context, this is especially dangerous because the available tools include messaging, location, camera, audio recording, and hardware/system controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly says the MCP tools are available directly with 'no curl, no API calls needed,' but later instructs use of shell/ADB commands for setup, SMS sending, app launching, and IME changes. This inconsistency can mislead operators and downstream agents about the real execution surface, causing them to permit shell-capable behavior they did not expect or properly constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script enables wireless ADB on TCP port 5555, which exposes a powerful device-management interface over the network. If the phone is connected to an untrusted or shared network, another host may be able to discover and interact with ADB, increasing the risk of unauthorized device access or weakening the expected USB-only trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This line transmits sensitive authentication material and device-identifying data to an external service. Because the command uses curl -sk, TLS certificate validation is disabled, substantially increasing the risk of credential theft, backend impersonation, or interception during transmission.

Content

Scanner excerpt · scripts/reconnect-adb.sh (reported line 15)May include surrounding context.

sh

fi

echo -n "Connecting adb via SSH tunnel... "
RESULT=$(curl -sk -X POST "$BACKEND/api/adb/connect" \
  -H "Content-Type: application/json" \
  -H "x-clawpaw-secret: $SECRET" \
  -d "{\"uid\":\"$UID\"}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends a secret credential to a remote backend in the x-clawpaw-secret header and provides no warning about credential transmission, storage, or exposure risk. This is made more concerning by the use of curl -k, which disables TLS certificate validation and increases the chance that the secret could be intercepted by a man-in-the-middle attacker.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This request sends the same secret to an external service in order to execute a remote action on the phone. In the context of a phone-control setup skill, such behavior is expected, but it is still security-sensitive because compromised transport or backend misuse could lead to unauthorized device control.

Content

Scanner excerpt · scripts/reconnect-adb.sh (reported line 25)May include surrounding context.

sh

if echo "$RESULT" | grep -q "already connected\|connected to"; then
  echo ""
  echo "OK — testing with press_key home..."
  curl -sk -X POST "$BACKEND/api/adb/press_key" \
    -H "Content-Type: application/json" \
    -H "x-clawpaw-secret: $SECRET" \
    -d "{\"uid\":\"$UID\",\"key\":\"home\"}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs downloading an APK from the internet, installing it on the device, and deleting a file afterward, all without an explicit warning or confirmation that device state will be modified. In an agentic setting, these actions can cause unreviewed software installation and state changes on a user's phone, which is risky even if the package appears legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs enabling and switching the active input method to ADBKeyboard without clearly warning that this changes the user's keyboard configuration. Changing the default IME affects how all text input is handled and may surprise users or route sensitive input through a different keyboard than expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to match generic requests like fixing typing or setting up a keyboard, which can cause the skill to activate in contexts the user did not intend. Because this skill performs installation and configuration changes, accidental invocation increases the risk of unauthorized or unexpected device modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill directs the agent to capture a photo and collect precise location, address, time, and weather context as part of a single workflow, but it does not instruct the agent to obtain explicit informed consent for each privacy-sensitive action or warn the user that these data will be gathered and combined. Because the workflow creates a rich, linkable record of the user's surroundings and whereabouts, an ambiguous trigger like 'check in' could result in over-collection of sensitive personal data beyond what the user reasonably expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill explicitly instructs the system to collect and aggregate highly sensitive user data, including location trajectory, dwell times, and notification activity, but provides no privacy notice, consent check, or data-minimization guidance. In a phone-control/assistant context, this increases the risk of over-collection, unexpected surveillance, and disclosure of intimate behavioral patterns to a user who may not realize the scope of data being processed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases such as '帮我打卡' and '飞书签到' are broad enough to match normal conversation and can activate a skill that performs a real-world state-changing action. In this context, accidental invocation is more dangerous because the skill automates employment attendance records, which are sensitive and consequential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs attendance check-in and even late check-in remediation without an explicit warning or confirmation that it will alter work records. This is dangerous because it can create unauthorized or mistaken submissions, potentially affecting payroll, compliance, or disciplinary records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to retrieve and disclose the phone's last known location without any explicit consent, confirmation, or privacy warning. Even in a legitimate 'find my phone' context, location data is sensitive and could expose a user's home, workplace, or recent movements if invoked by another person with access to the assistant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to fetch current location coordinates and real-time weather without requiring a user-facing notice or consent checkpoint. This creates a privacy risk because sensitive contextual data is accessed and used for personalization without transparency, which can surprise users or violate platform privacy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions require use of Chinese-language keywords such as "早餐", "午餐", and POI type "餐饮" regardless of user preference or locale. This imposes a specific language/locale behavior without opt-in or justification, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description includes broad trigger phrases like 'post to Instagram', 'share on IG', and 'upload a photo to Instagram', which can cause the skill to activate on loosely related requests. Because this skill performs high-impact UI actions that can lead to public posting, accidental invocation increases the risk of unintended social media actions or the agent entering a sensitive publish flow without sufficiently specific user intent.

Content

No source excerpt is available for this finding.