Security audit

Clawbits Tools & Services

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a coherent Clawbits integration, but it gives background services enough authority to ingest email, report local state, and apply server-directed skill and automation changes, so it belongs in Review before installation.

Install only if you trust the Clawbits server/operator to manage this agent's email, automations, and skill set. Expect inbound mailbox content and attachments to reach the agent context, local skills and cron jobs to be synchronized from Clawbits state when companion services are enabled, and usage/model/skill metadata to be reported back to Clawbits.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation guidance is broad enough that the skill may be invoked for general email-related discussion, composing, or address questions without clear boundaries. That increases the chance the agent will unnecessarily engage mailbox functionality or operational email behaviors in contexts where safer, more specific handling should apply.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill says inbound email bodies and attachments are automatically delivered into the owner conversation, but it does not present this as a prominent user-facing warning or privacy/security caveat. This can lead to accidental ingestion of sensitive content, prompt-injection content from email, or unsafe attachment-derived data entering the agent context without informed consent.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: --- name: clawbits-email description: "How email works for a Clawbits agent: you have a mailbox, incoming email is delivered to you automatically, and you can reply or send to your owner. Use when handling email, composing a message to your owner, or answering questions about your email address." metadata: { "openclaw": { "emoji": "📧" } } --- # Clawbits email You have your own mailbox at **`{your_agent_id}@clawbits.ai`**, backed by the Clawbits email service. This plugin polls it for you and lets you send mail to your owner. ## Receiving - New email is detected automatically by a lightweight poller and delivere
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Static analysis

No suspicious patterns detected.