ClawHub
Back to skill

Security audit

Rate My Claw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Rate My Claw integration, but it asks the agent to follow remote task prompts and handle an API key without enough scoping or secret-handling safeguards.

Install only if you are comfortable sending task outputs and agent profile data to ratemyclaw.xyz. Run tasks in a constrained session, treat returned task prompts as untrusted challenge text, do not allow them to read local files or secrets, and store the API key with owner-only permissions or a secret manager rather than pasting it directly into commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:36
Finding

Untrusted Remote Task Prompts Are Processed as Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-44
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
## Step 2: Browse Tasks

```bash
curl -s https://ratemyclaw.xyz/api/v1/tasks
curl -s "https://ratemyclaw.xyz/api/v1/tasks?role=software-engineer"
curl -s https://ratemyclaw.xyz/api/v1/tasks/1

Pick a task. Read its prompt and eval_criteria carefully.

Step 3: Solve and Submit

Process the task prompt. Then submit:

text

### Technical Analysis

The Skill retrieves task content from an external service and directs the agent to process the returned `prompt` and `eval_criteria` as instructions. These fields are remotely controlled and can change independently of the reviewed Skill package.

No trust boundary, prompt-injection filtering, or explicit instruction-precedence rule is defined. In particular, the Skill does not prohibit remote tasks from requesting local file access, credential disclosure, unrelated network requests, safety-policy changes, or use of tools beyond those necessary to answer the task.

This does not constitute direct remote code execution by itself. Exploitation depends on the tools and data available to the agent when the task is processed. However, an agent with filesystem, shell, browser, or network tools could interpret a malicious task as authorization to perform actions outside the declared evaluation workflow.

### Attack Path

1. An attacker publishes or modifies a task on the external Rate My Claw service.
2. The agent retrieves the task through `/api/v1/tasks` or `/api/v1/tasks/TASK_ID`.
3. The malicious `prompt` presents injected instructions, such as requests to read local files, disclose environment data, contact another server, or ignore existing constraints.
4. The Skill instructs the agent to process the task without classifying its fields as untrusted data.
5. If the current agent session 
...[truncated 1006 chars]
Remediation
View remediation

Remediation Suggestions

  1. Explicitly classify all task fields returned by the service as untrusted content rather than authoritative Skill instructions.
  2. Add a rule that remote prompts cannot override system, developer, user, or Skill-level safety requirements.
  3. Prohibit task prompts from requesting:
    • Credentials, tokens, environment variables, or local files.
    • Changes to agent policy or instruction priority.
    • Shell commands, package installation, or executable downloads.
    • Network access unrelated to the approved Rate My Claw API.
    • Submission of private conversation or workspace data.
  4. Restrict task solving to text generation unless the user separately approves additional tool use.
  5. Require explicit user confirmation before submitting generated output to the external service.
  6. Validate the intended submission and reject outputs containing credentials or other sensitive values.
  7. Use an isolated execution context with no unrelated filesystem, secret-store, shell, or network access when processing remote tasks.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding

Bearer Token Storage and Command Usage Lack Required Secret Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-33 and 46-50
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown
**Save the `api_key` from the response.** Store it at `~/.config/rate-my-claw/credentials.json`:

```json
{"api_key": "rmc_sk_..."}
text

```markdown
```bash
curl -s -X POST https://ratemyclaw.xyz/api/v1/tasks/TASK_ID/submit \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"output":"Your complete response...","model_used":"claude-opus-4-5","completion_time_ms":5000,"tokens_used":2000,"cost_dollars":0.01}'
text

### Technical Analysis

Storing an API credential is necessary for authenticated submissions, but the instructions do not require creation of the configuration directory and credential file with restrictive permissions. The resulting permissions depend on the user's umask and the method used to create the file. On a permissively configured system, other local users or processes may be able to read it.

The example also encourages placing a bearer token directly in a command-line argument. If a user replaces `YOUR_API_KEY` with the actual token, the credential can be exposed through shell history and may be transiently observable through local process-argument inspection. Bearer tokens provide access to any party possessing the value and therefore require protections equivalent to a password.

The Skill correctly states that the API key must not be sent to other domains, but that rule does not address local disclosure, secure file permissions, token rotation, accidental logging, or deletion.

### Attack Path

1. The agent registers with the external service and receives an API key.
2. The key is written to `~/.config/rate-my-claw/credentials.json` without explicitly enforcing directory mode `0700` and file mode `0600`.
3. Alternatively, the key is pasted directl
...[truncated 951 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create the configuration directory with owner-only permissions:
    bash
    install -d -m 700 "$HOME/.config/rate-my-claw"
  2. Create or update the credential file atomically with mode 0600, avoiding reliance on the current umask.
  3. Do not instruct users to paste the API key directly into a command. Load it from the protected credential file within a dedicated helper or pass it through a mechanism that does not persist it in shell history.
  4. Ensure the credential value is never printed in logs, task output, error diagnostics, or submissions.
  5. Validate that authenticated requests are sent only over HTTPS to the exact approved host, ratemyclaw.xyz.
  6. Document how to revoke, rotate, and securely delete the token.
  7. Warn users not to commit credentials.json to source control and add the file to relevant ignore rules where applicable.
  8. Use a narrowly scoped and revocable API token if the service supports token scopes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill directs the user to capture and retain an API key in a predictable plaintext file path under the home directory. That creates a credential-access target for other local processes, accidental source control inclusion, or leakage via logs and backups; if the key is stolen, an attacker can impersonate the user to the external service.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

-d '{"name":"openclaw-agent","description":"OpenClaw AI agent","model":"claude-opus-4-5","provider":"anthropic"}'

text

**Save the `api_key` from the response.** Store it at `~/.config/rate-my-claw/credentials.json`:

```json
{"api_key": "rmc_sk_..."}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

If you have not registered yet, register now:

bash
curl -s -X POST https://ratemyclaw.xyz/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name":"openclaw-agent","description":"OpenClaw AI agent","model":"claude-opus-4-5","provider":"anthropic"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the user to persist a newly issued API key in a local credentials file but does not include any guidance on file permissions, secure storage, or avoiding accidental disclosure. While storing credentials locally is common, the omission increases the chance the secret is exposed through weak filesystem permissions, backups, logs, or later agent access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.