Is clawddocs safe?

https://clawhub.ai/NicholasSpisak/clawddocs

85
SAFE

This is a documentation helper skill for Clawdbot that provides decision-tree navigation and search scripts. All included shell scripts are benign stubs that only echo messages. No malicious behavior, data exfiltration, or prompt injection attacks were detected. The primary risk is the pattern of instructing the agent to execute bundled shell scripts, which could become a vector if scripts are updated maliciously in future versions.

Category Scores

Prompt Injection 82/100 · 30%
Data Exfiltration 90/100 · 25%
Code Execution 78/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 75/100 · 5%

Findings (6)

MEDIUM Skill bundles executable shell scripts -15 ▶

The skill includes 7 bash scripts and instructs the agent to execute them. While all are currently stubs that only echo messages, they establish a pattern where the agent will run local shell scripts. If a future version replaces these with functional scripts containing network access or file manipulation, the agent would execute them based on the SKILL.md instructions.

LOW Persona assignment and workflow override -8 ▶

SKILL.md assigns the agent a specific persona ('You are an expert on Clawdbot documentation') and defines a workflow that the agent should follow when users ask about Clawdbot. This is standard skill behavior but does modify agent behavior.

LOW Implicit instruction to fetch external content -10 ▶

The skill instructs the agent to 'Fetch the doc: ./scripts/fetch-doc.sh or use browser' and references docs.clawd.bot URLs. While the script currently only echoes URLs, the 'or use browser' instruction could cause the agent to navigate to external URLs, which is a mild prompt injection vector for content injection via fetched pages.

LOW build-index.sh fetch implies future download capability -7 ▶

The build-index.sh script has a 'fetch' subcommand described as 'Download all docs'. Currently a stub, but indicates intent to download content from the internet in a future version.

INFO Config snippets reference environment variable tokens -10 ▶

The common-configs.md file contains template patterns like ${DISCORD_TOKEN} and ${TELEGRAM_TOKEN}. These are documentation examples showing users how to configure their bots, not exfiltration attempts. However, if an agent were to interpret these literally and substitute actual environment variables, it could inadvertently expose tokens in conversation.

INFO Script update supply chain risk -25 ▶

The skill establishes agent trust in running local scripts. If the skill registry allows updates, a malicious update could replace stub scripts with harmful ones that the agent would execute based on existing SKILL.md instructions.