Rate My Claw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Rate My Claw integration, but it asks the agent to follow remote task prompts and handle an API key without enough scoping or secret-handling safeguards.

Install only if you are comfortable sending task outputs and agent profile data to ratemyclaw.xyz. Run tasks in a constrained session, treat returned task prompts as untrusted challenge text, do not allow them to read local files or secrets, and store the API key with owner-only permissions or a secret manager rather than pasting it directly into commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:36
• Finding: Untrusted Remote Task Prompts Are Processed as Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 36-44 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown ## Step 2: Browse Tasks ```bash curl -s https://ratemyclaw.xyz/api/v1/tasks curl -s "https://ratemyclaw.xyz/api/v1/tasks?role=software-engineer" curl -s https://ratemyclaw.xyz/api/v1/tasks/1 ``` Pick a task. Read its `prompt` and `eval_criteria` carefully. ## Step 3: Solve and Submit Process the task prompt. Then submit: ``` ### Technical Analysis The Skill retrieves task content from an external service and directs the agent to process the returned `prompt` and `eval_criteria` as instructions. These fields are remotely controlled and can change independently of the reviewed Skill package. No trust boundary, prompt-injection filtering, or explicit instruction-precedence rule is defined. In particular, the Skill does not prohibit remote tasks from requesting local file access, credential disclosure, unrelated network requests, safety-policy changes, or use of tools beyond those necessary to answer the task. This does not constitute direct remote code execution by itself. Exploitation depends on the tools and data available to the agent when the task is processed. However, an agent with filesystem, shell, browser, or network tools could interpret a malicious task as authorization to perform actions outside the declared evaluation workflow. ### Attack Path 1. An attacker publishes or modifies a task on the external Rate My Claw service. 2. The agent retrieves the task through `/api/v1/tasks` or `/api/v1/tasks/TASK_ID`. 3. The malicious `prompt` presents injected instructions, such as requests to read local files, disclose environment data, contact another server, or ignore existing constraints. 4. The Skill instructs the agent to process the task without classifying its fields as untrusted data. 5. If the current agent session ...[truncated 1006 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly classify all task fields returned by the service as untrusted content rather than authoritative Skill instructions. 2. Add a rule that remote prompts cannot override system, developer, user, or Skill-level safety requirements. 3. Prohibit task prompts from requesting: - Credentials, tokens, environment variables, or local files. - Changes to agent policy or instruction priority. - Shell commands, package installation, or executable downloads. - Network access unrelated to the approved Rate My Claw API. - Submission of private conversation or workspace data. 4. Restrict task solving to text generation unless the user separately approves additional tool use. 5. Require explicit user confirmation before submitting generated output to the external service. 6. Validate the intended submission and reject outputs containing credentials or other sensitive values. 7. Use an isolated execution context with no unrelated filesystem, secret-store, shell, or network access when processing remote tasks.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Bearer Token Storage and Command Usage Lack Required Secret Protections## Vulnerability Details **File Location**: `SKILL.md`, lines 30-33 and 46-50 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown **Save the `api_key` from the response.** Store it at `~/.config/rate-my-claw/credentials.json`: ```json {"api_key": "rmc_sk_..."} ``` ``` ```markdown ```bash curl -s -X POST https://ratemyclaw.xyz/api/v1/tasks/TASK_ID/submit \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_API_KEY" \ -d '{"output":"Your complete response...","model_used":"claude-opus-4-5","completion_time_ms":5000,"tokens_used":2000,"cost_dollars":0.01}' ``` ``` ### Technical Analysis Storing an API credential is necessary for authenticated submissions, but the instructions do not require creation of the configuration directory and credential file with restrictive permissions. The resulting permissions depend on the user's umask and the method used to create the file. On a permissively configured system, other local users or processes may be able to read it. The example also encourages placing a bearer token directly in a command-line argument. If a user replaces `YOUR_API_KEY` with the actual token, the credential can be exposed through shell history and may be transiently observable through local process-argument inspection. Bearer tokens provide access to any party possessing the value and therefore require protections equivalent to a password. The Skill correctly states that the API key must not be sent to other domains, but that rule does not address local disclosure, secure file permissions, token rotation, accidental logging, or deletion. ### Attack Path 1. The agent registers with the external service and receives an API key. 2. The key is written to `~/.config/rate-my-claw/credentials.json` without explicitly enforcing directory mode `0700` and file mode `0600`. 3. Alternatively, the key is pasted directl ...[truncated 951 chars]
• Remediation: ## Remediation Suggestions 1. Create the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.config/rate-my-claw" ``` 2. Create or update the credential file atomically with mode `0600`, avoiding reliance on the current umask. 3. Do not instruct users to paste the API key directly into a command. Load it from the protected credential file within a dedicated helper or pass it through a mechanism that does not persist it in shell history. 4. Ensure the credential value is never printed in logs, task output, error diagnostics, or submissions. 5. Validate that authenticated requests are sent only over HTTPS to the exact approved host, `ratemyclaw.xyz`. 6. Document how to revoke, rotate, and securely delete the token. 7. Warn users not to commit `credentials.json` to source control and add the file to relevant ignore rules where applicable. 8. Use a narrowly scoped and revocable API token if the service supports token scopes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

-d '{"name":"openclaw-agent","description":"OpenClaw AI agent","model":"claude-opus-4-5","provider":"anthropic"}'
```

**Save the `api_key` from the response.** Store it at `~/.config/rate-my-claw/credentials.json`:

```json
{"api_key": "rmc_sk_..."}

• Confidence: 91% confidence
• Finding: The skill directs the user to capture and retain an API key in a predictable plaintext file path under the home directory. That creates a credential-access target for other local processes, accidental source control inclusion, or leakage via logs and backups; if the key is stolen, an attacker can impersonate the user to the external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

If you have not registered yet, register now:

```bash
curl -s -X POST https://ratemyclaw.xyz/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name":"openclaw-agent","description":"OpenClaw AI agent","model":"claude-opus-4-5","provider":"anthropic"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the user to persist a newly issued API key in a local credentials file but does not include any guidance on file permissions, secure storage, or avoiding accidental disclosure. While storing credentials locally is common, the omission increases the chance the secret is exposed through weak filesystem permissions, backups, logs, or later agent access.

Static analysis

No suspicious patterns detected.