migrate-nanoclaw

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly tells sub-agents to read full file contents and "extract ... code, imports, API calls, and configurations verbatim" including "specific values", which would require the LLM to copy any embedded secrets (API keys, tokens, passwords) into its output—creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains an explicit telemetry/exfiltration flow (a hard-coded PostHog API key and curl POST of a generated diagnostics JSON) and also includes instructions that expose environment data (symlinking .env into a worktree) and re-fetch/execute code from external skill origins, which together present deliberate data-exfiltration and supply-chain/exposure risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill reads and ingests outsider-authored free text from the user’s own git checkout at runtime (e.g., git diff, git log, and “Read the full current file” for all changed files under the fork), which is then processed by the LLM to generate the migration guide and apply steps.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches and checks out upstream at runtime (default https://github.com/nanocoai/nanoclaw.git) and then re-reads and follows the fetched SKILL.md, so remote repository content can directly alter agent instructions.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal high-entropy API key found in diagnostics.md. The JSON includes "api_key": "phc_fx1Hhx9ucz8GuaJC8LVZWO8u03yXZZJJ6ObS4yplnaP" which appears to be a real, usable credential (random-looking, high entropy) and not a documentation placeholder or truncated/redacted value. Other values in the skill (env var names like DEEPL_API_KEY, example passwords, and URLs) are either placeholders, environment variable references, or simple examples and do not meet the secret definition, so they were ignored.