Versioned security assessment

Report ID: SA-5BCF41E5

6/30/2026, 11:14:43 AM

clawlabor security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: clawlabor
Version: v2
Maintainer: Reinforce-Omega
Source: github.com/Reinforce-Omega/clawlabor-skill/tree/main/
Coverage: 10 Files scanned · 2,568 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported command, network, filesystem, and environment-access patterns. Review confirms most command hits are documentation examples, but the skill legitimately performs authenticated marketplace API operations, manages API keys, installs files into hidden tool directories, and includes a long-running event listener that can release payments or select winners if invoked. No prompt injection or clear malicious intent was found, but community publication should require manual trust review and strong warnings.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,568 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 95 evidence locations

Filesystem access

May read or write local files.

Observed in 25 evidence locations

Env variables

May read values from the process environment.

Observed in 82 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 518 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High

SKILL.md:156-199 SKILL.md:208-230 SKILL.md:242-264 pipeline/pipeline.py:274-317

Authenticated Marketplace Actions Affect Credits and Escrow

The skill is designed to create orders, post paid tasks, confirm deliveries, claim work, and select winners using a bearer token. These are expected marketplace features, but they can freeze or release user credits if an agent runs them without explicit review.

The cited workflows and helper methods directly call authenticated order and task endpoints that control escrow, confirmations, and winner selection. This appears intentional for the marketplace, not malicious, but the financial impact is clear.

RISK-002 High

pipeline/pipeline.py:26-53 pipeline/pipeline.py:62-88 pipeline/pipeline.py:347-401

Persistent Event Listener Uses API Key for Continuous Network Activity

The bundled pipeline reads CLAWLABOR_API_KEY, attaches it to an httpx client, sends heartbeat requests, polls events, acknowledges events, and dynamically routes event handlers. This is functional for an agent marketplace, but it expands risk because a long-running process can act on account events.

The API key is loaded from the environment and used in Authorization headers for repeated network calls. The code also makes clear that the loop is continuous and event-driven.

RISK-003 Medium

bin/install.js:27-30 bin/install.js:45-70 bin/install.js:73-78 bin/install.js:114-126

Installer Writes and Removes Files in Hidden Tool Directories

The npm installer copies skill files into hidden Claude, OpenClaw, and Codex skill directories under the user home directory and can remove those target directories during uninstall. The paths are fixed and not attacker-controlled, but the installer modifies agent configuration areas.

The filesystem operations are explicit and target hidden skill directories. The fixed path construction lowers injection risk, but install and uninstall still change sensitive agent runtime locations.

RISK-004 Medium

SKILL.md:69-105 README.md:36-56

Credential Storage Guidance Uses Local Hidden Configuration File

The skill instructs users to store the returned API key in a credentials file under a hidden configuration path. This is common for CLI tooling, but it increases exposure if file permissions or local machine security are weak.

The documentation clearly directs users to handle and persist an API key. No exfiltration was found, but local credential storage is a real operational risk.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)

Low

examples/buyer-workflow.md:12-41 examples/provider-workflow.md:12-57 QUICKSTART.md:7-42 SKILL.md:146-199

Documentation Shell Examples Trigger Command Detection

Most external command findings are markdown examples for curl, npx, cp, and setup commands. They are not executed automatically by the skill, but users should review commands before running them because they invoke authenticated APIs.

The cited command patterns are fenced documentation examples, not code paths run by the package. Risk remains user-mediated because copying the commands can perform real API actions.

Low

SKILL.md:1-31 README.md:1-69

No Prompt Injection Attempt Found in Reviewed Files

Targeted review did not find text that tried to override the evaluator, skip security analysis, claim pre-approval, or impersonate system instructions. This lowers the chance that the large markdown surface is intentionally manipulating reviewers.

A targeted search for common prompt-injection phrases returned no matches, and the reviewed opening documentation describes normal product behavior. This is not a full semantic proof across every word, so confidence is high but not absolute.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable