ClawAudit verdict
TeamClaw
teamclawtest
Accesses credentials AND makes external network calls
TeamClaw scores 28/100 (Dangerous). It declares no permissions. 2 undeclared capabilities detected — the skill does more than its permissions suggest. 7 high-severity flags.
What it does
These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Permission integrity
network_out
credential_access
Findings (18)
HTTP request to bare IP address — common in malicious payloads
SKILL.md · code · http://127.0.0.1
Possible hardcoded credential
scripts/launcher.py · prose · downgraded · TOKEN=", content, re.MULTILINE):
content = re.sub(r
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
scripts/setup_env.sh · prose · downgraded · curl -LsSf https://astral.sh/uv/install.sh | sh
Pipe to sh — executes piped content as shell commands
scripts/setup_env.sh · prose · downgraded · | sh
Recursive delete from root or home — destructive command
src/mcp_commander.py · prose · downgraded · rm -rf /
Accesses sensitive system files
src/mcp_commander.py · prose · downgraded · /etc/passwd
References webhook/callback URL
SKILL.md · code · callback_url
subprocess execution — runs system commands from Python
packaging/build.py · prose · downgraded · subprocess.run(
Data URI with base64 payload — may embed malicious content
src/mainagent.py · prose · downgraded · data:application/pdf;base64,
References sudo — requests elevated privileges
src/mcp_commander.py · prose · downgraded · sudo
Python asyncio subprocess — async shell execution
src/mcp_commander.py · prose · downgraded · asyncio.create_subprocess_shell(
Python os.getenv — reads environment variable
chatbot/QQbot.py · prose · downgraded · os.getenv(
Python aiohttp session — async network access
chatbot/QQbot.py · prose · downgraded · aiohttp.ClientSession
Popular HTTP library — network access
oasis/scheduler.py · prose · downgraded · got
Python urllib.request — network access
scripts/launcher.py · prose · downgraded · urllib.request
Sets world-executable permissions
src/mcp_commander.py · prose · downgraded · chmod 777
Changes file ownership
src/mcp_commander.py · prose · downgraded · chown
Python os.environ.get — reads environment variable
src/mcp_commander.py · prose · downgraded · os.environ.get(
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/D/E). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
credential_accessnetwork_innetwork_out Thanks — recorded.