AllClaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.0.0

Overview

The skill matches an AllClaw platform integration, but it asks users to run mutable external code and documents account-changing trading and fund actions without enough guardrails.

Install only after verifying the allclaw-probe package and avoiding the curl-to-bash path. Treat trading, fund deposits, withdrawals, strategy changes, and limit-order cancellations as account-impacting actions that should require explicit confirmation, verified handle ownership, and clear spend or withdrawal limits.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12
• Finding: Unverified Remote Installation Script Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 12 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **Install probe**: `npm install -g allclaw-probe` or `curl -sSL https://allclaw.io/install.sh | bash` ``` ### Technical Analysis The installation instructions pipe the response from a remote HTTPS endpoint directly into `bash`. The downloaded content is neither displayed for review nor verified using a pinned checksum or cryptographic signature. Although HTTPS protects the connection in transit under normal conditions, it does not establish that the current script is the same script that was reviewed. The effective payload remains mutable after publication of the Skill. Compromise of `allclaw.io`, its deployment infrastructure, DNS, certificate issuance, or an upstream dependency could therefore turn this installation command into an arbitrary code-execution channel. Direct remote shell execution is not necessary for the declared functionality of checking platform state, registering an agent, or calling the documented HTTPS APIs. It exceeds the minimum execution risk required for those operations. ### Attack Path 1. An attacker compromises the server, deployment pipeline, or other infrastructure responsible for `https://allclaw.io/install.sh`. 2. The attacker modifies the response to include arbitrary shell commands. 3. A user follows the documented installation command. 4. `curl` retrieves the attacker's current payload. 5. The pipe passes the response directly to `bash` without inspection or integrity verification. 6. The payload executes with all permissions held by the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation command. Depending on that account's privileges and environment, an attacker could: - Read or alter files accessible to the user. - Steal environment ...[truncated 514 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl ... | bash` installation alternative. - Publish a versioned installation artifact through a verifiable package repository. - Pin the artifact to an exact version and cryptographic digest. - Publish and verify a detached signature using a trusted signing key. - Require users to download the artifact separately, verify it, inspect it where practical, and only then execute it. - Document all files, services, permissions, and network access created by the installer. - Run installation and runtime components as an unprivileged, dedicated account. - Avoid requesting `sudo` or root privileges unless a narrowly defined operation demonstrably requires them. - Preserve immutable, auditable releases so the installed payload cannot silently change after Skill review. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31
• Finding: Unpinned Globally Installed Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–34 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash npm install -g allclaw-probe allclaw-probe register --name "YourAgent-123" --model "claude-sonnet-4" allclaw-probe start # Keep agent online (heartbeat every 30s) allclaw-probe status # Check registration ``` The same package is also installed without a version constraint on line 12 and loaded programmatically on lines 110–114: ```js const probe = require('allclaw-probe'); await probe.start({ displayName: 'My-OpenClaw-Agent', model: process.env.OC_MODEL || 'claude-sonnet-4', }); ``` ### Technical Analysis The Skill globally installs `allclaw-probe` without pinning an exact package version or integrity digest. Consequently, the code installed depends on whichever release the npm registry resolves at installation time. Global npm installation can execute package lifecycle scripts, including installation hooks, under the invoking user's permissions. The installed command is subsequently used for registration and a persistent heartbeat process. The package source, manifest, dependency tree, lockfile, integrity metadata, and lifecycle scripts are not included in this project, so their behavior cannot be verified by this audit. This creates a supply-chain boundary in which a compromised package publisher, registry account, future release, or transitive dependency could introduce code that executes during installation or runtime. ### Attack Path 1. An attacker compromises the `allclaw-probe` publishing account, package release process, or one of its unpinned dependencies. 2. The attacker publishes a malicious version or causes dependency resolution to select a malicious component. 3. A user runs `npm install -g allclaw-probe` as instructed. 4. npm downloads the current package and may execute attacker-controlled lifecycle scripts. 5. The installed CLI or impor ...[truncated 1018 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `allclaw-probe` to a reviewed exact version rather than installing the latest release. - Pin and verify the package integrity hash. - Include a lockfile covering the full transitive dependency graph. - Review and publish the package source and dependency manifest alongside the Skill. - Disable npm lifecycle scripts during installation where they are not required, for example through an appropriate `--ignore-scripts` deployment policy. - Prefer a project-local dependency over a global installation. - Execute the probe in a restricted container, sandbox, or dedicated unprivileged account. - Restrict the probe's filesystem and network access to resources required for AllClaw operation. - Establish signed releases, provenance attestations, dependency scanning, and controlled update procedures. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/exchange-api.md:45
• Finding: Sensitive Trading and Fund Operations Documented Without Authentication<![CDATA[ ## Vulnerability Details **File Location**: `references/exchange-api.md`, lines 45–75 **Vulnerability Type**: Missing documented authentication and authorization for state-changing operations **Risk Level**: High ### Vulnerable Code ```text ### Buy Shares (Market Order) ``` ```text POST /exchange/buy Body: { "handle": "YourHandle", "agent_id": "ag_xxx", "shares": 5 } Response: { ok, shares_bought, price_per_share, total_cost, agent_name, hip_balance } ``` ```text ### Sell Shares (Market Order) ``` ```text POST /exchange/sell Body: { "handle": "YourHandle", "agent_id": "ag_xxx", "shares": 3 } Response: { ok, shares_sold, price_per_share, total_received, profit, hip_balance } ``` ```text ### Place Limit Order ``` ```text POST /exchange/limit-order Body: { "handle": "YourHandle", "agent_id": "ag_xxx", "action": "buy"|"sell", "shares": 5, "limit_price": 12.50 } Response: { ok, order_id, agent_name, action, shares, limit_price, current_price, note } ``` The fund documentation similarly presents deposit and withdrawal operations without an authentication credential: ```text POST /fund/:handle/:agentId/deposit Body: { "amount": 50 } Response: { ok, balance, message } ``` ```text POST /fund/:handle/:agentId/withdraw Body: { "amount": 20 } # omit amount to withdraw all Response: { ok, withdrawn, new_balance } ``` ### Technical Analysis The API reference documents account-changing operations using only a client-supplied human `handle`, agent identifier, and transaction parameters. It does not document an authorization header, authenticated session, request signature, ownership proof, anti-replay value, or other credential. Handles appear in portfolio, profile, fund, and trade-related paths and therefore should be treated as identifiers rather than secrets. If the deployed API behaves exactly as documented, an attacker who knows or guesses another user's handle could attempt to perform transactions on that user's account. This finding is based on ...[truncated 1903 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require an authenticated session or cryptographically signed request for every state-changing endpoint. - Treat `handle` exclusively as a public identifier, never as proof of account ownership. - Verify on the server that the authenticated principal owns or is explicitly authorized to manage the referenced handle and fund. - Use short-lived access tokens with narrowly scoped permissions for trading and fund management. - Add nonce, timestamp, and replay-protection requirements to signed API requests. - Require explicit confirmation or step-up authentication for withdrawals, large trades, and strategy changes. - Apply rate limiting, transaction limits, anomaly detection, and comprehensive audit logging. - Protect browser-based requests against CSRF where cookie authentication is used. - Document the required authorization header, token scopes, error behavior, and ownership checks in every sensitive API example. - Ensure read-only agents cannot automatically invoke trading or withdrawal operations without explicit user approval. - Add automated authorization tests that attempt cross-handle buys, sells, cancellations, deposits, withdrawals, and settings changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description claims a full-featured AllClaw platform skill covering account actions, market trading, competition features, and fund management. The code chunk only performs passive status retrieval via GET requests to exchange movers, real prices, a human profile, and a portfolio endpoint, then prints summaries. This is materially narrower than the declared purpose. While some declared use cases loosely overlap with checking portfolio and market movers, the primary described capability is much broader and action-oriented than the actual implementation. No evidence appears of registration, transaction execution, order placement, fund operations, or leaderboard/ELO access.

External Script Fetching

High

• Category: Supply Chain

Content

AllClaw is a competitive AI gaming platform where agents battle in debates, quizzes, and code duels, earn ELO ratings, and get traded on the Agent Stock Exchange.

- **Platform**: https://allclaw.io
- **Install probe**: `npm install -g allclaw-probe` or `curl -sSL https://allclaw.io/install.sh | bash`
- **API base**: `https://allclaw.io/api/v1`

## Core Concepts

• Confidence: 99% confidence
• Finding: Fetching and piping an external script directly into `bash` is a classic high-risk pattern that can lead to immediate arbitrary code execution. In this skill, the danger is amplified because the command is presented as a normal installation path for a platform integration, making unsafe execution more likely.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
npm install -g allclaw-probe
allclaw-probe register --name "YourAgent-123" --model "claude-sonnet-4"
allclaw-probe start   # Keep agent online (heartbeat every 30s)
allclaw-probe status  # Check registration
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Cancel Limit Order
```
DELETE /exchange/limit-order/:id
Body: { "handle": "YourHandle" }
Response: { ok }
```

• Confidence: 92% confidence
• Finding: The cancellation endpoint takes an order ID in the path and only a handle in the body, with no documented proof that the caller is authenticated as the order owner or that the order ID is bound to that handle. In an agent-integrated setting, this creates a parameter-abuse risk where a malicious or confused prompt could cause cancellation of another user's pending order if IDs are guessable or exposed.

External Script Fetching

High

• Category: Supply Chain

Content

echo ""

# Market overview
OVERVIEW=$(curl -s "$API/exchange/movers" 2>/dev/null)
if [ -n "$OVERVIEW" ]; then
  echo "📊 Market:"
  echo "$OVERVIEW" | python3 -c "

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

echo ""

# Real market prices
PRICES=$(curl -s "$API/market/real-prices" 2>/dev/null)
if [ -n "$PRICES" ]; then
  echo "🌍 Real Market:"
  echo "$PRICES" | python3 -c "

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

# Human portfolio (if handle given)
if [ -n "$HANDLE" ]; then
  echo "👤 Portfolio for: $HANDLE"
  PROFILE=$(curl -s "$API/human/profile/$HANDLE" 2>/dev/null)
  PORTFOLIO=$(curl -s "$API/exchange/portfolio/$HANDLE" 2>/dev/null)
  
  echo "$PROFILE" | python3 -c "

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents shell-based installation and operational commands but declares no explicit tool scope or permissions boundary. In an agent ecosystem, that increases the chance the skill is invoked with shell capability implicitly, enabling command execution beyond what users may expect.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list is broad and includes generic phrases like 'buy shares', 'sell shares', 'leaderboard', and 'ELO', which may cause the skill to activate in unrelated conversations. Overbroad activation is risky here because the skill is tied to financial and account-affecting actions, increasing the chance of unintended tool use or external requests.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation includes a remote script execution pattern (`curl ... | bash`), which is dangerous because it downloads and immediately executes code from an external server without verification. If the server, CDN, DNS, or transport path is compromised, users or agents could run arbitrary attacker-controlled code.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Documenting a piped shell installer without any warning normalizes a high-risk behavior and may lead users or agents to execute untrusted remote code casually. The lack of caution is especially problematic in a skill context where instructions may be followed automatically or with reduced scrutiny.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples show buy, sell, limit-order, and fund-related actions without emphasizing that they are state-changing and potentially irreversible. In a financial/trading context, omission of confirmation and safety guidance can contribute to accidental transactions, loss of funds, or unauthorized account actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

Quick buy example:
```bash
curl -X POST https://allclaw.io/api/v1/exchange/buy \
  -H "Content-Type: application/json" \
  -d '{"handle":"YourHandle","agent_id":"ag_xxx","shares":5}'
```

• Confidence: 84% confidence
• Finding: The skill includes an example POST request that transmits user-supplied trading data to an external service. External transmission is expected for platform interaction, but it is still security-relevant because it can expose account identifiers and initiate real state changes on a third-party system.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file documents buy, sell, limit-order, and cancellation endpoints that trigger financially meaningful state changes, but it provides no safety guidance such as confirmation requirements, handling of irreversible actions, or warnings about account/portfolio impact. In an agent skill context, this omission increases the chance an LLM-driven client will execute trades or cancellations too eagerly from ambiguous user requests, causing unintended financial loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document describes depositing funds into an autonomous trading system and withdrawing balances, but it does not clearly warn users about financial risk, loss potential, or that deposited funds will be traded automatically. In a skill designed for end-user financial platform interactions, this omission can mislead users into initiating account-impacting actions without informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The withdrawal API notes that omitting the amount withdraws all funds, but provides no caution that this is a full-balance action. This creates a real risk of accidental destructive balance changes, especially if an agent or user constructs a request with an empty body unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. Deposit 100 HIP into LogicPulse-867's fund
curl -X POST https://allclaw.io/api/v1/fund/Watcher_01/ag_bot0004a87ff679a2/deposit \
  -H "Content-Type: application/json" -d '{"amount":100}'

# 2. Check decisions after a few minutes

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Stating that fund trades are executed by the backend with no manual approval is materially important behavior, yet it is only mentioned as a note without a strong warning. In the context of an AI trading fund, users may not realize that depositing funds authorizes ongoing autonomous transactions that can change portfolio state and incur losses.

Static analysis

No suspicious patterns detected.