claw-control Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

claw-control is an AI agent skill, created by adarshmishra07 and published at adarshmishra07/claw-control. ClawSecure audited claw-control across 76 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 46 findings concentrate in Command Injection, Data Exfiltration and Code Injection, including Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |... and Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |.... 25 were rated high or critical severity.

Is claw-control safe?

ClawSecure audited claw-control and assigned a security score of 0/100 (High Risk), identifying 46 findings across Command Injection and Data Exfiltration. Review the findings below before installing.

What did ClawSecure find in claw-control?

ClawSecure identified 46 findings in claw-control, concentrated in Command Injection, Data Exfiltration and Code Injection. 25 were rated high or critical severity. The most severe include Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |... and Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |....

How was claw-control audited?

ClawSecure ran claw-control through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 76 files from adarshmishra07/claw-control.

What does a score of 0 mean?

ClawSecure assigned claw-control a security score of 0/100, placing it in the High Risk range. This is driven by 46 findings led by Command Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for claw-control

ClawSecure detected 46 security findings in claw-control, spanning Command Injection, Data Exfiltration, Code Injection and Policy Violation.

critical · Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:71.
critical · Variable $TASK_ID (tainted at line 56: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:79.
critical · Variable $TASK_ID (tainted at line 93: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:104.
critical · Variable $TASK_ID (tainted at line 93: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:109.
critical · Variable $TASK_ID (tainted at line 123: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:131.
critical · Variable $TASK_ID (tainted at line 123: `TASK_ID=$(echo "$BODY" |.... Data Exfiltration finding detected in packages/backend/scripts/test-template-field.sh:136.
high · Variable $AUTH_HEADER (line 20) flows to `curl` at line 71.. Command Injection finding detected in packages/backend/scripts/test-template-field.sh:71.
high · Variable $ST_RESP (tainted at line 71: `ST_RESP=$(curl -s.... Command Injection finding detected in packages/backend/scripts/test-template-field.sh:72.
high · Variable $ST_RESP (tainted at line 71: `ST_RESP=$(curl -s.... Command Injection finding detected in packages/backend/scripts/test-template-field.sh:75.
high · Variable $AUTH_HEADER (line 20) flows to `curl` at line 79.. Command Injection finding detected in packages/backend/scripts/test-template-field.sh:79.
high · Variable $AUTH_HEADER (line 20) flows to `curl` at line 104.. Command Injection finding detected in packages/backend/scripts/test-template-field.sh:104.
high · Variable $ST_RESP (tainted at line 104: `ST_RESP=$(curl -s.... Command Injection finding detected in packages/backend/scripts/test-template-field.sh:105.

Showing the 12 highest-severity of 46 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for claw-control

Harden command execution

claw-control constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Audit external network connections

claw-control sends data to external endpoints. Confirm each destination is expected and authorized, and remove any callback that exfiltrates data. ClawSecure monitors for known exfiltration and C2 endpoints.

Eliminate dynamic code execution

claw-control evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.

Related Security Research

Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→

Related AI Agent Security Audits

openclaw-master-skillsScore 0/100 6bc837afc1a86e89Score 0/100 6bc837afc1a86e89Score 0/100 a4b01e81f20e9814Score 0/100 understand-anythingScore 0/100

Scanned on March 6, 2026. claw-control is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan