Is clawddocs safe?
https://clawhub.ai/skill/clawddocs
The clawddocs skill is a documentation helper for Clawdbot that provides decision-tree navigation, search scripts, and config snippets. The skill is largely benign — all shell scripts are stubs with echo-only output, no sensitive files are accessed, canary files are untouched, and network activity during install is limited to expected registry communication. The primary risk surface is the 7 shell scripts that the SKILL.md instructs the agent to execute, which could become attack vectors in future version updates.
Category Scores
Findings (7)
MEDIUM Shell scripts instructed for agent execution -28 ▶
SKILL.md instructs the LLM agent to execute 7 shell scripts in ./scripts/. While currently stubs with echo-only output, these scripts establish a pattern where the agent will run them on command. A future version update could introduce malicious payloads in these scripts that the agent would execute without additional user confirmation.
LOW Persona assignment and behavioral directives -15 ▶
SKILL.md assigns the agent a specific identity ('You are an expert on Clawdbot documentation') and prescribes a detailed workflow including decision trees, script execution order, and output formatting requirements. While benign in intent, this demonstrates the skill's ability to direct agent behavior.
LOW Agent directed to fetch external URLs -10 ▶
The skill instructs the agent to fetch documentation from docs.clawd.bot via shell scripts and potentially via browser tool. While the domain is legitimate and related to the skill's purpose, this establishes a pattern of external URL fetching directed by skill content.
LOW External network connection during install -15 ▶
A TLS connection to 216.150.1.1:443 was established during skill installation. This is likely the clawhub.ai registry performing the install, which is expected behavior, but the IP should be verified.
INFO Config snippets contain token placeholders -10 ▶
The snippets/common-configs.md file contains configuration templates with environment variable references like ${DISCORD_TOKEN} and ${TELEGRAM_TOKEN}. These are standard placeholder patterns and do not expose actual secrets, but users should be aware the agent may display these patterns.
INFO No npm lifecycle scripts 0 ▶
package.json contains no preinstall, postinstall, or other lifecycle scripts. The package is cleanly declared with only metadata fields.
INFO All honeypot files untouched 0 ▶
No canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were accessed or modified during the skill installation or execution.