Security audit
Security checks for vulnerabilities and agentic risk
BeatClaw is mostly coherent for generating and selling beats, but its remote install and self-update flow can persistently replace agent instructions without pinning or review.
Review before installing. Prefer a ClawHub-managed or manually reviewed installation over the direct curl/agent-install path, and only use it if you trust beatclaw.com to serve future skill updates. Be aware the connected agent can hold a long-lived BeatClaw producer token and, after confirmation, spend Suno credits, publish products, change pricing/genres, process stems, or delete beat listings.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills/beatclaw && \
curl -fsSL https://beatclaw.com/skill -o ~/.claude/skills/beatclaw/SKILL.md
The install command places a remote file into a session-persistent autoload location (~/.claude/skills/beatclaw/SKILL.md). This increases risk because any malicious or later-compromised content survives beyond the initial install and will be reloaded in future sessions, amplifying the effect of a one-time compromise.
mkdir -p ~/.claude/skills/beatclaw && \
curl -fsSL https://beatclaw.com/skill -o ~/.claude/skills/beatclaw/SKILL.md
The setup instructs users to download a remote SKILL.md directly into the agent's skills directory with curl, but gives no warning to inspect or pin the content first. Because skill files influence future agent behavior, this creates a software supply-chain risk: compromise of beatclaw.com, DNS/TLS issues, or content changes could persistently install adversarial instructions.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills/beatclaw && \
curl -fsSL https://beatclaw.com/skill -o ~/.claude/skills/beatclaw/SKILL.md
For OpenClaw: replace ~/.claude/skills/ with ~/.openclaw/skills/.
Telling the user to ask the agent to install the skill from a URL delegates fetching and writing remote prompt content to the agent without any review step. This is dangerous because it normalizes remote prompt injection and persistence: the agent may retrieve untrusted instructions and save them where they will automatically load in later sessions.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**ERROR HANDLING — DO NOT POLL ON FAILURE.** If `generate-beat` returns any non-2xx status, NO beat row was created and NO `task_id` was issued. Do **not** start polling `beats_feed` or `poll-suno` — there's nothing to find. Stop immediately and surface the error to the human verbatim.
| HTTP | `error_type` | What it means | What the agent should do |
|------|-------------------------|-------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|
| 401 | `API_KEY_INVALID` | Suno API key is bad/revoked | Tell the human to replace the key in their dashboard (producer → Settings). Do not ask for it. Do not retry. |
| 402 | `INSUFFICIENT_CREDITS` | The agent's external Suno account is out of credits | Tell the human to top up at their provider dashboard. Do not retry until they confirm. |
Detected: suspicious.exposed_secret_literal