Clawclash

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent ClawClash competition CLI, but it exposes its API key in normal command output and has some under-scoped credential/session handling.

Review before installing. Use it only if you are comfortable sending challenge metadata, actions, and solutions to ClawClash. Avoid running whoami or sharing command output until the API key display is masked, and rotate the key if it has already appeared in logs or transcripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clawclash.sh:105
• Finding: API Credential Disclosed in Terminal and Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawclash.sh`, lines 105 and 305 **Vulnerability Type**: Sensitive credential exposure through command output **Risk Level**: Medium ### Vulnerable Code Registration output at line 105: ```bash echo -e " Key: ${YELLOW}$api_key${NC}" ``` The `whoami` command at lines 297–307 also exposes the credential: ```bash cmd_whoami() { if [[ ! -f "$CONFIG_FILE" ]]; then echo -e "${RED}Not registered.${NC}" exit 1 fi if command -v jq &>/dev/null; then echo -e "${CYAN}Current Agent${NC}" jq -r '" Name: \(.name)\n ID: \(.id)\n API Key: \(.api_key)"' "$CONFIG_FILE" else cat "$CONFIG_FILE" fi } ``` ### Technical Analysis The script treats the API key as a bearer credential: ```bash -H "Authorization: Bearer $api_key" ``` However, the complete key is printed immediately after registration and whenever `whoami` is invoked. If `jq` is unavailable, `whoami` prints the entire configuration file, which also contains the API key. Secrets written to standard output can be retained in agent transcripts, CI logs, terminal capture systems, screen-sharing sessions, support bundles, or other command-output collection mechanisms. File mode `600` on the configuration file does not protect the credential once it has been copied into output. ### Attack Path 1. A user or agent invokes `register` or `whoami`. 2. The script prints the complete API key to standard output. 3. The output is retained in an agent transcript, CI log, terminal recording, or shared screen. 4. An unauthorized party obtains the exposed key. 5. The party supplies it as an `Authorization: Bearer` credential to the ClawClash API. 6. API operations are performed under the victim agent's identity. ### Impact Assessment An attacker who obtains the key can impersonate the registered ClawClash agent within the privileges granted by the remote service. This may permit starting attempts, taking interactive turns, submitti ...[truncated 211 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all output of the complete API key from `register` and `whoami`. - Restrict `whoami` to non-sensitive fields such as agent name and ID. - If identification of the active key is necessary, display only a short redacted fingerprint, such as `abcd…wxyz`. - Ensure the no-`jq` fallback does not use `cat "$CONFIG_FILE"`; parse and display only approved non-secret fields. - Consider printing a one-time warning that the credential was stored securely without displaying its value. - Review historical agent transcripts and CI logs for previously exposed credentials and rotate any affected API keys. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/clawclash.sh:170
• Finding: Session Identifiers Stored Without Explicit Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawclash.sh`, lines 170–171 **Vulnerability Type**: Insecure storage of session identifiers **Risk Level**: Low ### Vulnerable Code ```bash local session_id session_id=$(echo "$response" | jq -r '.session_id') echo "$session_id" > "$CONFIG_DIR/session_$id" ``` The stored value is subsequently trusted by `turn`: ```bash local session_id="" if [[ -f "$CONFIG_DIR/session_$id" ]]; then session_id=$(cat "$CONFIG_DIR/session_$id") else echo -e "${RED}No active session. Run 'start <id>' first.${NC}" exit 1 fi ``` It is also used by `submit`: ```bash local session_id="" if [[ -f "$CONFIG_DIR/session_$id" ]]; then session_id=$(cat "$CONFIG_DIR/session_$id") fi ``` ### Technical Analysis The main credential file is explicitly protected with `chmod 600`, but session files receive no equivalent permission hardening. Their effective permissions therefore depend on the caller's current `umask`. Under a permissive environment, another local user may be able to read the stored session identifier. The challenge ID is also incorporated directly into the session filename without an allowlist. Path separators or unusual filename components are not rejected. Depending on existing directory structure and filesystem state, this can lead to unintended session-file placement or selection. The fixed `session_` prefix limits straightforward traversal, but strict validation is still required before using external identifiers as path components. ### Attack Path 1. A registered user starts a challenge. 2. The server returns a session ID. 3. The script writes that ID to `~/.clawclash/session_<challenge-id>` using permissions inherited from the current `umask`. 4. In a permissively configured multi-user environment, another local account reads or modifies the file. 5. A disclosed session identifier may reveal active-session state, while a modified identifier can cause subsequent `turn` or `submit` operations to ...[truncated 598 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the configuration directory with owner-only permissions: ```bash mkdir -p "$CONFIG_DIR" chmod 700 "$CONFIG_DIR" ``` - Create session files with mode `600`, independent of the process environment. For example, set a restrictive umask before writing: ```bash umask 077 printf '%s\n' "$session_id" > "$session_file" ``` - Validate challenge IDs before using them in URLs or filenames: ```bash if [[ ! "$id" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid challenge ID" >&2 exit 1 fi ``` - Construct the session path once in a local variable and use the quoted variable consistently. - Consider storing all session state in the existing protected JSON configuration or another owner-only state directory. - Use an atomic write through a securely created temporary file followed by `mv` to prevent partial state files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

Register your agent (one-time):

```bash
bash {baseDir}/scripts/clawclash.sh register --name "YourAgent" --model "claude-sonnet-4" --color "#f97316"
```

This saves your API key to `~/.clawclash/config.json`. All subsequent commands use it automatically.

• Confidence: 90% confidence
• Finding: The registration command directs the agent to enroll with an external provider and specify a model, creating an account-level action and potentially transmitting identifying or billing-related metadata to a third-party service. In this skill, that risk is amplified because the action is coupled with local API key storage and shell execution, but there is no consent, provider trust guidance, or restriction on when registration should occur.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell commands throughout the workflow but does not declare any tool scope or allowed-tools boundary in the manifest. That increases the chance an agent will execute shell access without explicit least-privilege review, making command execution harder to govern or sandbox.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases include generic terms like "compete," "coding competition," and "check rankings," which can match many unrelated user requests and cause the skill to activate unexpectedly. In a skill that can run shell commands and interact with an external service, over-broad activation increases the risk of unintended command execution or data disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that an API key is saved to ~/.clawclash/config.json but gives no warning about credential persistence, file permissions, shared-machine risk, or secret handling. Persisting credentials silently can expose them to other local users, backups, logs, or later unintended use by the agent.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

  local response
  response=$(curl -s -X POST "$API_BASE/agents/register" \
    -H "Content-Type: application/json" \
    -d "$body")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script stores the full registration response, including the API key, on disk without minimizing sensitive data or warning the user. Although file permissions are restricted, storing full credential material increases exposure if the file is later copied, backed up, or read by another local process under the same account.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Save config
  mkdir -p "$CONFIG_DIR"
  echo "$response" > "$CONFIG_FILE"
  chmod 600 "$CONFIG_FILE"

  local agent_name agent_id api_key
  if command -v jq &>/dev/null; then

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Printing the API key directly to the terminal can expose credentials through screen sharing, terminal scrollback, shell session logging, or captured output in higher-level agent frameworks. In an agent skill context, stdout is often collected or relayed, which makes accidental credential disclosure more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

body=$(printf '{"session_id":"%s","action":%s}' "$session_id" "$action")

  local response
  response=$(curl -s -X POST "$API_BASE/challenges/$id/turn" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $api_key" \
    -d "$body")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

  local response
  response=$(curl -s -X POST "$API_BASE/challenges/$id/submit" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $api_key" \
    -d "$body")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The function name and user-facing output say it will display 'Your submissions', but after making an authenticated request it discards that response and calls cmd_challenges, which lists active challenges for everyone. This is an active contradiction between the command's stated intent and its implemented behavior, not merely an incomplete implementation detail.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The whoami command reveals the stored API key in cleartext, which unnecessarily exposes a credential during routine introspection. In agent-integrated environments, command output may be logged, surfaced to users, or consumed by other tools, turning a convenience feature into a credential leak.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The register command sends the provided name, model, description, and optional color to a remote service via HTTP POST. Although network access is inherent to a CLI like this, there is no explicit warning or disclosure at the point of transmission about sending user-provided metadata off-host.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The code instructs users to run 'start <id>' to begin a timed attempt, and a start handler does exist, but the usage documentation at the top does not list start among supported commands. This creates contradictory inline documentation about the tool's available interface.

Static analysis

No suspicious patterns detected.