# clawdbot is a security nightmare

Source: https://www.youtube.com/watch?v=kSno1-xOjwI
Recap page: https://rapidrecap.app/video/kSno1-xOjwI
Generated: 2026-01-27T17:15:46.219+00:00

---
## Quick Overview

The security nightmare surrounding Clawbot stems from its inherent design, which combines powerful system access (running locally, full system access) with the need to process arbitrary user data from various chat applications, creating a significant prompt injection risk where the LLM can be tricked into executing unauthorized commands or exposing sensitive API keys stored in plain text.

**Key Points:**
- Clawbot is an AI tool that runs locally and connects to many chat apps (WhatsApp, Telegram, Discord, etc.) to automate tasks using LLMs.
- The tool requires 'Full System Access' and can read/write files, run shell commands, and execute scripts, granting significant operational capability.
- The inherent security issue is that Clawbot processes both system prompts and user input together, making it susceptible to prompt injection attacks that can override instructions.
- The presenter cites real-world examples, including vulnerabilities like CVE-2025-55182 (React2Shell), to illustrate the danger of LLMs processing untrusted data.
- API keys for integrated services (like Google Workspace) are stored in plain text in the credentials directory, making compromise of the host machine critical.
- The onboarding process explicitly warns users that the tool is 'powerful and inherently risky,' suggesting starting in a sandbox environment.

![Screenshot at 00:16: The Clawbot homepage displays its core promise: "THE AI THAT ACTUALLY DOES THINGS," detailing features like running on the machine, chat app integration, and full system access, visually setting up the discussion on its power and associated risks.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-00-16.jpg)

**Context:** The video discusses Clawbot, an AI assistant tool that integrates with numerous chat applications (like WhatsApp, Discord, Telegram) and runs locally on the user's machine, promising powerful automation capabilities including browser control and full system access. The presenter examines the security implications of such a tool, particularly focusing on the risk of prompt injection attacks, which exploit the LLM's inability to distinguish between system instructions and user-provided data.

## Detailed Analysis

The video critiques Clawbot, an AI tool designed to automate tasks across various platforms by integrating with chat applications via a locally running agent. The presenter highlights that Clawbot's features, such as 'Full System Access' (read/write files, run shell commands) and 'Persistent Memory,' grant it significant power. The core security concern discussed is prompt injection, where the LLM fails to separate system instructions from user input, as demonstrated by examples like the React2Shell vulnerability (CVE-2025-55182). The presenter points out that API keys for integrated services, such as Google, are stored in plain text in the `~/.clawbot/credentials` directory, meaning if the host machine is compromised, all connected accounts are at risk. Clawbot's own onboarding process warns that it is 'powerful and inherently risky' and recommends using a sandbox initially. The tool's ability to process arbitrary data from chat applications (like emails or Discord messages) directly into the LLM without proper segregation is the primary vector for these prompt injection attacks, allowing malicious data to override system instructions and potentially execute unauthorized actions.

### Clawbot Overview

- Runs on Your Machine
- Any Chat App Integration
- Persistent Memory
- Browser Control
- Full System Access
- Skills & Plugins

### Security Concerns

- Prompt injection risk due to LLM processing combined instruction/user data
- API keys stored in plain text in ~/.clawbot/credentials
- Vulnerabilities like CVE-2025-55182 illustrate LLM risks.

### Onboarding Process

- Requires user acknowledgment that the tool is 'powerful and inherently risky'
- Recommends starting with a sandbox environment for new users.

### Attack Vectors Discussed

- Prompt injection via chat data allowing control plane influence
- Data plane vs. control plane data confusion in LLMs.

### Sponsor Segment (Flare)

- Flare intelligence platform provides insight into cyber threats, including tracking Telegram discussions about vulnerabilities like React2Shell.

![Screenshot at 00:23: The 'What It Does' section of the Clawbot website highlights features like 'Full System Access' and 'Skills & Plugins,' emphasizing the powerful, local nature of the agent.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-00-23.jpg)
![Screenshot at 01:17: The presenter shows the Clawbot documentation detailing 'Skills' and precedence rules for loading them, illustrating the complexity of its operational environment.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-01-17.jpg)
![Screenshot at 01:44: The Clawbot Control dashboard showing the 'Gateway Access' section with the WebSocket URL and Gateway Token, confirming the agent is connected.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-01-44.jpg)
![Screenshot at 05:37: The CLI onboarding process explicitly warns the user: 'I understand this is powerful and inherently risky. Continue?' followed by Yes/No options.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-05-37.jpg)
![Screenshot at 06:04: The 'Skills' section within the Clawbot control panel, listing enabled and blocked integrations like 'gog' \(Google Workspace CLI\) and 'goplaces,' showing where API keys would be managed.](https://ss.rapidrecap.app/screens/kSno1-xOjwI/00-06-04.jpg)