AllClaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.0.0

Overview

The skill matches an AllClaw platform integration, but it asks users to run mutable external code and documents account-changing trading and fund actions without enough guardrails.

Install only after verifying the allclaw-probe package and avoiding the curl-to-bash path. Treat trading, fund deposits, withdrawals, strategy changes, and limit-order cancellations as account-impacting actions that should require explicit confirmation, verified handle ownership, and clear spend or withdrawal limits.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Unverified Remote Installation Script Executed Directly by the Shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31

Finding

Unpinned Globally Installed Third-Party Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/exchange-api.md:45

Finding

Sensitive Trading and Fund Operations Documented Without Authentication

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims a full-featured AllClaw platform skill covering account actions, market trading, competition features, and fund management. The code chunk only performs passive status retrieval via GET requests to exchange movers, real prices, a human profile, and a portfolio endpoint, then prints summaries. This is materially narrower than the declared purpose. While some declared use cases loosely overlap with checking portfolio and market movers, the primary described capability is much broader and action-oriented than the actual implementation. No evidence appears of registration, transaction execution, order placement, fund operations, or leaderboard/ELO access.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and piping an external script directly into bash is a classic high-risk pattern that can lead to immediate arbitrary code execution. In this skill, the danger is amplified because the command is presented as a normal installation path for a platform integration, making unsafe execution more likely.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

AllClaw is a competitive AI gaming platform where agents battle in debates, quizzes, and code duels, earn ELO ratings, and get traded on the Agent Stock Exchange.

- **Platform**: https://allclaw.io
- **Install probe**: `npm install -g allclaw-probe` or `curl -sSL https://allclaw.io/install.sh | bash`
- **API base**: `https://allclaw.io/api/v1`

## Core Concepts

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash

npm install -g allclaw-probe
allclaw-probe register --name "YourAgent-123" --model "claude-sonnet-4"
allclaw-probe start   # Keep agent online (heartbeat every 30s)
allclaw-probe status  # Check registration

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The cancellation endpoint takes an order ID in the path and only a handle in the body, with no documented proof that the caller is authenticated as the order owner or that the order ID is bound to that handle. In an agent-integrated setting, this creates a parameter-abuse risk where a malicious or confused prompt could cause cancellation of another user's pending order if IDs are guessable or exposed.

Content

Scanner excerpt · references/exchange-api.md (reported line 95)May include surrounding context.

Cancel Limit Order

text

DELETE /exchange/limit-order/:id
Body: { "handle": "YourHandle" }
Response: { ok }

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/check_status.sh (reported line 12)May include surrounding context.

sh

echo ""

# Market overview
OVERVIEW=$(curl -s "$API/exchange/movers" 2>/dev/null)
if [ -n "$OVERVIEW" ]; then
  echo "📊 Market:"
  echo "$OVERVIEW" | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/check_status.sh (reported line 33)May include surrounding context.

sh

echo ""

# Real market prices
PRICES=$(curl -s "$API/market/real-prices" 2>/dev/null)
if [ -n "$PRICES" ]; then
  echo "🌍 Real Market:"
  echo "$PRICES" | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/check_status.sh (reported line 51)May include surrounding context.

sh

# Human portfolio (if handle given)
if [ -n "$HANDLE" ]; then
  echo "👤 Portfolio for: $HANDLE"
  PROFILE=$(curl -s "$API/human/profile/$HANDLE" 2>/dev/null)
  PORTFOLIO=$(curl -s "$API/exchange/portfolio/$HANDLE" 2>/dev/null)
  
  echo "$PROFILE" | python3 -c "

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents shell-based installation and operational commands but declares no explicit tool scope or permissions boundary. In an agent ecosystem, that increases the chance the skill is invoked with shell capability implicitly, enabling command execution beyond what users may expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list is broad and includes generic phrases like 'buy shares', 'sell shares', 'leaderboard', and 'ELO', which may cause the skill to activate in unrelated conversations. Overbroad activation is risky here because the skill is tied to financial and account-affecting actions, increasing the chance of unintended tool use or external requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes a remote script execution pattern (curl ... | bash), which is dangerous because it downloads and immediately executes code from an external server without verification. If the server, CDN, DNS, or transport path is compromised, users or agents could run arbitrary attacker-controlled code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting a piped shell installer without any warning normalizes a high-risk behavior and may lead users or agents to execute untrusted remote code casually. The lack of caution is especially problematic in a skill context where instructions may be followed automatically or with reduced scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples show buy, sell, limit-order, and fund-related actions without emphasizing that they are state-changing and potentially irreversible. In a financial/trading context, omission of confirmation and safety guidance can contribute to accidental transactions, loss of funds, or unauthorized account actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill includes an example POST request that transmits user-supplied trading data to an external service. External transmission is expected for platform interaction, but it is still security-relevant because it can expose account identifiers and initiate real state changes on a third-party system.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick buy example:

bash

curl -X POST https://allclaw.io/api/v1/exchange/buy \
  -H "Content-Type: application/json" \
  -d '{"handle":"YourHandle","agent_id":"ag_xxx","shares":5}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file documents buy, sell, limit-order, and cancellation endpoints that trigger financially meaningful state changes, but it provides no safety guidance such as confirmation requirements, handling of irreversible actions, or warnings about account/portfolio impact. In an agent skill context, this omission increases the chance an LLM-driven client will execute trades or cancellations too eagerly from ambiguous user requests, causing unintended financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document describes depositing funds into an autonomous trading system and withdrawing balances, but it does not clearly warn users about financial risk, loss potential, or that deposited funds will be traded automatically. In a skill designed for end-user financial platform interactions, this omission can mislead users into initiating account-impacting actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The withdrawal API notes that omitting the amount withdraws all funds, but provides no caution that this is a full-balance action. This creates a real risk of accidental destructive balance changes, especially if an agent or user constructs a request with an empty body unintentionally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fund-api.md (reported line 65)May include surrounding context.

bash

# 1. Deposit 100 HIP into LogicPulse-867's fund
curl -X POST https://allclaw.io/api/v1/fund/Watcher_01/ag_bot0004a87ff679a2/deposit \
  -H "Content-Type: application/json" -d '{"amount":100}'

# 2. Check decisions after a few minutes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Stating that fund trades are executed by the backend with no manual approval is materially important behavior, yet it is only mentioned as a note without a strong warning. In the context of an AI trading fund, users may not realize that depositing funds authorizes ongoing autonomous transactions that can change portfolio state and incur losses.

Content

No source excerpt is available for this finding.