InterClaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:25 PM UTC
• Version: 0.1.9

Overview

This skill has a coherent email-coordination purpose, but it needs review because it handles mail and PGP credentials, persistent message archives, and unaudited helper commands with under-scoped security guidance.

Review this before installing on a real mailbox. Use a dedicated email account, avoid putting passwords in command history, prefer app-specific credentials or a secret manager, verify any helper scripts and downloaded binaries yourself, and assume ~/.interclaw may contain sensitive message history and keys unless you add your own retention and file-permission controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Agent Communication Behavior Hijacking Through Mandatory Skill Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: docs/protocol-v3.md:14

Finding

Reusable Shared Authentication Secret May Be Sent in Unencrypted Email

Content

View full analysis

``` ``` ```markdown ### When Encryption is OPTIONAL - `[COORD]`, `[INTEL]`, `[RELAY]`, `[MULTI]` — sender's discretion - `[PING]`, `[ACK]`, `[RECV]` — never encrypted (low-value, high-frequency) ``` The example wire format also includes the reusable value inside a signed but plaintext message: ```text X-Agent-ID: Donna/1.0 X-Agent-Secret: weekly-rotate-abc123 Harvey, let's sync on sprint priorities. ``` The corresponding configuration declares: ```dotenv # Rotating shared secret for X-Agent-Secret header (optional) INTERCLAW_SHARED_SECRET="" ``` ### Technical Analysis The protocol describes `X-Agent-Secret` as an optional rotating shared authentication secret and places it in the mandatory message-header structure. At the same time, it permits several message classes to remain unencrypted and requires `[PING]`, `[ACK]`, and `[RECV]` messages to be unencrypted. A PGP signature protects integrity and authenticates the signing key, but it does not provide confidentiality. Consequently, any reusable secret included in a signed plaintext message remains visible to SMTP relays, mailbox providers, message archives, mail-security gateways, diagnostic systems, and anyone who later obtains mailbox access. The documentation does not clearly state that `X-Agent-Secret` must be omitted from every unencrypted message. The supplied wire-format example reinforces the unsafe behavior by showing the ...[truncated 1133 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Email and PGP Credentials Are Accepted Through Command-Line Arguments and Plaintext Environment Files

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Downloaded Mail Client Dependency Has No Declared Integrity Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The initialization examples pass SMTP/IMAP passwords directly on the command line, which can expose secrets through shell history, process listings, audit logs, CI logs, or terminal scrollback. In an agent skill context, this is more dangerous because users may copy-paste commands verbatim into shared or automated environments where credential leakage persists beyond the session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 253)May include surrounding context.

Or manual: symlink scripts yourself

chmod +x scripts/interclaw-* mkdir -p ~/.local/bin ln -sf "$(pwd)"/scripts/interclaw-* ~/.local/bin/

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The protocol explicitly specifies persistent storage of configuration, logs, message archives, trusted keys, and conversation state under ~/.interclaw/, but it does not define retention limits, access controls, encryption at rest, or operator warnings about privacy and forensic exposure. In a messaging system intended for sensitive agent-to-agent coordination, indefinite local retention can leak metadata and plaintext content through disk compromise, backups, multi-user access, or later unintended disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description says 'No servers. No WebSockets. No cloud dependency' and later says the tool is 'not a mail client', yet the same README instructs users to configure SMTP/IMAP accounts and recommends cloud email providers, with curl listed as a prerequisite for HTTP requests. While SMTP/IMAP are expected for an email-based coordination tool, the absolute 'No cloud dependency' wording overstates the implementation reality described elsewhere in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The Quick Start says the bootstrap step installs packages and creates symlinks, which modifies the user's system state. While the action is noted briefly, there is no explicit warning or caution that this step changes the local environment and PATH-related tooling setup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation makes an absolute claim that non-InterClaw mail is never touched. However, the adjacent example for Maildir processing shows iterating over all files in ~/Maildir/new/* and moving each processed file to ~/Maildir/cur/, which is handling mailbox content beyond merely ignoring InterClaw-unrelated messages. That is a direct contradiction at the intent/documentation level.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.