ClawHub
Back to skill

Security audit

clawddocs

Security checks for vulnerabilities and agentic risk

Overview

This Clawdbot docs helper looks benign, though its scripts are mostly placeholders and some configuration examples need security care.

Use this skill as lightweight Clawdbot documentation guidance, not as a fully functional docs search system. Before copying its snippets, store provider tokens securely, keep session directories private, and bind the gateway to localhost unless you intentionally need remote access with authentication, TLS, and firewall controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
snippets/common-configs.md:32
Finding

Gateway Configuration Exposes Service on All Network Interfaces

Content
View full analysis

Vulnerability Details

File Location: snippets/common-configs.md, lines 32–38
Vulnerability Type: Unsafe network exposure in a ready-to-use configuration
Risk Level: Medium

Vulnerable Code:

json
{
  "gateway": {
    "host": "0.0.0.0",
    "port": 8080
  }
}

Technical Analysis

The configuration binds the gateway to 0.0.0.0, causing it to listen on every available network interface rather than restricting access to the local host. The example does not include authentication, TLS, firewall restrictions, or reverse-proxy access controls.

Because this is presented as a reusable configuration snippet, a user may deploy it unchanged. This violates the principle of secure defaults and increases the gateway's attack surface. The binding is not itself an authentication bypass, but it can make otherwise locally scoped gateway functionality reachable by remote systems.

Attack Path

  1. A user copies the provided gateway configuration into a deployment.
  2. The gateway starts on TCP port 8080 and listens on all network interfaces.
  3. The host firewall, container port mapping, cloud security group, or local network permits access to that port.
  4. An attacker discovers the exposed service through network scanning or knowledge of the host address.
  5. The attacker connects to the gateway and accesses any endpoints or operations that are not independently protected by authentication and authorization controls.
  6. If sensitive gateway functionality is available without adequate controls, the attacker may read exposed data or invoke gateway operations within the service's existing privilege boundary.

Impact Assessment

Exploitation can provide unauthorized network access to gateway functionality that was intended to remain local. The precise privileges depend on the gateway's independent authentication and authorization mechanisms, which are not shown in the audited snippet. Potential sco ...[truncated 324 chars]

Remediation
View remediation

Remediation Suggestions

  • Change the default binding to the loopback interface:
    json
    {
  "gateway": {
    "host": "127.0.0.1",
    "port": 8080
  }
}
  • Document that 0.0.0.0 should only be used when remote access is explicitly required.
  • Require strong authentication and authorization before exposing the gateway to any network.
  • Terminate TLS through the gateway or a hardened reverse proxy.
  • Restrict inbound access using host firewalls, cloud security groups, container networking rules, or network allowlists.
  • Run the gateway under a dedicated, unprivileged operating-system account.
  • Add a warning beside the public-binding example and provide separate secure examples for local-only and intentionally remote deployments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description promises a broad documentation assistant with multiple capabilities, including navigation, search, fetching docs, version tracking, and config snippets. The supplied code chunk is much narrower: it merely echoes a constructed docs.clawd.bot URL based on an input path. It neither retrieves documentation content nor implements the other advertised features. This is a material mismatch between the declared purpose and the actual behavior of the provided code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a comprehensive documentation expert with multiple capabilities across Clawdbot documentation, including navigation, search, fetching, version tracking, and config snippets. The actual code chunk is only a minimal shell script that echoes a message about recently updated docs and accepts an optional days argument. It does not perform document retrieval, searching, decision-tree navigation, version tracking, or config generation. While the script loosely relates to documentation updates, its implemented behavior is far narrower than the declared purpose, making this a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction 'Use this skill to help users navigate, understand, and configure Clawdbot' combined with the broad examples in the decision tree makes invocation conditions expansive and not tightly bounded. The file does not provide negative examples or specific trigger phrases that distinguish when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file shows users how to configure DISCORD_TOKEN, TELEGRAM_TOKEN, and a local WhatsApp session directory, but it does not include any user-facing warning about handling secrets or persisted authentication data safely. Because markdown files should warn about behaviors affecting privacy or system integrity, the omission is a quality/safety gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.