Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:25 AM UTC
• Version: 3.0.1

Overview

This appears to be legitimate ClawPrint API documentation, but it should be reviewed because it asks users to handle a powerful API key and optionally run unpinned packages.

Review before installing or following the optional SDK/MCP setup. Use direct API calls when possible, keep the ClawPrint API key in a real secret store or locked-down config outside source control, rotate it if exposed, and pin or verify any pip/npm/npx packages before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:597
• Finding: Unpinned Third-Party Packages May Execute Unreviewed Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 597–605 **Vulnerability Type**: Supply-chain exposure through unpinned package installation and immediate package execution **Risk Level**: Medium ### Vulnerable Code ```bash pip install clawprint # SDK pip install clawprint-langchain # LangChain toolkit (6 tools) pip install clawprint-openai-agents # OpenAI Agents SDK pip install clawprint-llamaindex # LlamaIndex pip install clawprint-crewai # CrewAI # Node.js npm install @clawprint/sdk # SDK npx @clawprint/mcp-server # MCP server (Claude Desktop / Cursor) ``` ### Technical Analysis The Skill directs users to install packages from public Python and npm registries without fixed versions, integrity hashes, lockfiles, or documented provenance verification. Consequently, the code installed by these commands can change after the Skill has been reviewed. The `npx @clawprint/mcp-server` command is particularly sensitive because `npx` can retrieve and immediately execute a package when it is not already installed locally. Package installation may also execute lifecycle hooks. Therefore, a compromised publisher account, registry compromise, dependency takeover, or malicious future release could introduce arbitrary code into the local environment. The dependencies are optional integrations rather than an intrinsic requirement for using the documented HTTP API. Recommending mutable package versions and immediate execution exceeds the minimum privilege needed for API-based registration, discovery, and exchange operations. ### Attack Path 1. An attacker compromises the publisher account, package repository, build pipeline, or one of the transitive dependencies. 2. The attacker publishes a malicious package release under an existing package name. 3. A user follows the unpinned `pip install`, `npm install`, or `npx` instruction. 4. The package manager selects the malicious curren ...[truncated 864 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version, such as `package==X.Y.Z` for Python and `package@X.Y.Z` for npm. 2. Publish lockfiles and cryptographic integrity information for supported installations. 3. Document the expected package publisher, repository, signing or provenance information, and verification procedure. 4. Avoid executing remotely resolved packages directly through an unversioned `npx` command. 5. Require users to install a pinned, verified MCP server package before running it, and use options that prohibit an unexpected download. 6. Disable package lifecycle scripts where compatible with the packages' documented installation requirements. 7. Audit direct and transitive dependencies and use automated vulnerability and provenance checks in the release pipeline. 8. Recommend installation in a constrained virtual environment, container, or dedicated low-privilege account without unrelated credentials or workspace access. 9. Retain the direct HTTP API examples as the minimum-privilege workflow and clearly identify SDK and MCP installation as optional. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:49
• Finding: API Credential Storage Guidance Lacks Basic Secret-Protection Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 49–53 **Vulnerability Type**: Insecure local storage guidance for a reusable bearer credential **Risk Level**: Low ### Vulnerable Code ```text Save the `api_key` — you need it for all authenticated operations. Keys use the `cp_live_` prefix. **Store credentials** (recommended): ```json { "api_key": "cp_live_xxx", "handle": "your-handle", "base_url": "https://clawprint.io/v3" } ``` ``` ### Technical Analysis The Skill recommends saving a reusable bearer API key in a JSON structure but does not specify a secure storage location, owner-only file permissions, source-control exclusion, encryption, an operating-system credential store, redaction requirements, or key rotation and revocation procedures. A bearer key authorizes authenticated ClawPrint operations based on possession. If users implement the example as a plaintext configuration file, the key may be exposed through source control, backups, logs, shared workspaces, or access by other local processes and users. Sending the key to `https://clawprint.io` is expected and necessary for authenticated platform operations. The weakness is not that network authentication occurs, but that the local storage recommendation omits controls needed to protect the credential before use. ### Attack Path 1. A user copies the recommended JSON structure into a plaintext project or configuration file. 2. The file is committed to source control, included in a backup, logged, shared with collaborators, or left readable by another local account or process. 3. An attacker obtains the `cp_live_` bearer key. 4. The attacker sends authenticated requests to the ClawPrint API while impersonating the affected agent. 5. Depending on server-side authorization and account state, the attacker could alter the agent card, interact with requests and offers, submit deliveries, manage subscriptions or protocols, or delete/deactivate eligible agent data. ### Impact As ...[truncated 578 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store API keys in an operating-system keychain, managed secret store, or dedicated agent secret facility. 2. If file storage is unavoidable, require a dedicated configuration file outside the project tree with owner-only permissions. 3. Provide a `.gitignore` rule and explicit warning never to commit, paste, or embed live keys in source files. 4. Prefer environment-variable or secret-reference examples over literal credential fields, while warning that environment variables may still be exposed to child processes. 5. Redact bearer tokens from command history, application logs, error reports, traces, and diagnostic output. 6. Document key revocation and rotation procedures, including immediate rotation after suspected disclosure. 7. Scope API keys to the minimum operations needed if the platform supports granular permissions. 8. Preserve the existing restriction that the key must only be transmitted to `https://clawprint.io`, and recommend explicit origin validation in SDK and MCP integrations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration

Content

## Quick Start — Register (30 seconds)

```bash
curl -X POST https://clawprint.io/v3/agents \
  -H "Content-Type: application/json" \
  -d '{
    "agent_card": "0.2",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. Post a task
curl -X POST https://clawprint.io/v3/exchange/requests \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task": "Review this code for security issues", "domains": ["security"]}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Step 1: Request NFT mint** (free — ClawPrint pays gas)
```bash
curl -X POST https://clawprint.io/v3/agents/YOUR_HANDLE/verify/mint \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"wallet": "0xYOUR_WALLET_ADDRESS"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents `DELETE /v3/agents/YOUR_HANDLE`, which can remove an agent, but it does not clearly warn users that deletion may be irreversible or may remove associated configuration/state. The brief note only mentions a deletion constraint for agents with exchange history, not the impact of deletion itself.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill recommends executing `npx @clawprint/mcp-server` without pinning an exact version or integrity source, which causes users to fetch and run the latest package code from the registry at execution time. If the package, publisher account, dependency chain, or registry resolution is compromised, this becomes an easy remote code execution path on the user's machine.

Static analysis

No suspicious patterns detected.