ClawHub
Back to skill

Security audit

claw2ui

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly publishes user-approved dashboards to public web URLs and discloses the main privacy and installation risks.

Install only if you are comfortable with a global npm CLI, a saved local Claw2UI token, and publishing selected content to a public URL. Review generated page content carefully, use TTLs for temporary data, avoid --no-check unless you knowingly accept reduced validation, and do not publish secrets, PII, internal URLs, or sensitive business data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–20 and 54–58
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
install:
  - id: claw2ui-npm
    kind: npm
    package: claw2ui
    bins: ["claw2ui"]
    label: "Install Claw2UI CLI (npm install -g claw2ui)"
    verify: "https://github.com/0xsegfaulted/claw2ui"
bash
npm install -g claw2ui
claw2ui register --server https://0xsegfaulted-claw2ui.hf.space
# Done! Token saved to ~/.claw2ui.json automatically.

Technical Analysis

The installation command does not specify an exact package version, cryptographic integrity value, signature, lockfile, or immutable package artifact. As a result, npm resolves whichever release is current when the command is executed. The verify metadata points to a source repository but does not cryptographically verify that the installed registry artifact corresponds to reviewed source code.

npm packages may execute lifecycle scripts during installation. Because the command performs a global installation, malicious installation logic would execute with the privileges of the user running npm and could modify user-accessible global package directories and other user-writable resources.

This is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, publication credentials, or a future release.
  2. The attacker publishes a malicious release under the same package name.
  3. A user or agent follows the documented unversioned npm install -g claw2ui command.
  4. npm resolves and downloads the attacker-controlled current release.
  5. Malicious lifecycle or package code executes with the invoking user's privileges.
  6. The malicious code can access or alter resources available to that user, potent ...[truncated 601 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin claw2ui to a reviewed exact version in both metadata and commands, for example claw2ui@X.Y.Z.
  • Record and verify the expected package integrity digest or use registry/package signature verification.
  • Ensure the installed registry artifact is reproducibly linked to the reviewed source revision.
  • Prefer a project-local installation with a committed lockfile over a global installation.
  • Disable lifecycle scripts where compatible, such as with --ignore-scripts, or explicitly review all required lifecycle scripts.
  • Document the expected npm registry and reject unexpected registry overrides.
  • Run installation under a non-privileged account and avoid sudo npm install -g.
  • Periodically review and deliberately update the pinned version rather than automatically consuming the latest release.

T08 · Insecure Dependencies

Note
Location
ref/self-hosting.md:69
Finding

Unpinned Python CLI Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: ref/self-hosting.md, lines 69–73
Vulnerability Type: Supply-chain exposure through an unconstrained Python package and dependency set
Risk Level: Low

Vulnerable Code

bash
# Install hf CLI
pip install huggingface_hub[cli]
hf auth login

Technical Analysis

The optional Hugging Face deployment workflow installs huggingface_hub[cli] without an exact version, dependency lock, or package hashes. pip can therefore resolve a different direct package version and transitive dependency graph over time. Installation into an unspecified Python environment also risks modifying the host environment rather than an isolated deployment environment.

Python packages and build backends may execute code during source builds or installation. A compromise of the direct package, a transitive dependency, publication credentials, or dependency resolution could therefore lead to code execution with the installing user's privileges. This finding does not indicate that huggingface_hub is currently malicious.

Attack Path

  1. An attacker compromises a resolved package, transitive dependency, maintainer account, or distribution artifact.
  2. A malicious or substituted version becomes eligible under the unconstrained install command.
  3. An operator follows the self-hosting guide and runs pip install huggingface_hub[cli].
  4. pip resolves and installs the compromised dependency graph.
  5. Malicious build, installation, or runtime code executes as the operator.
  6. If the compromise remains active when hf auth login is performed, it may access credentials entered or stored by the CLI.

Impact Assessment

Exploitation could result in arbitrary code execution with the installing user's privileges and modification of the selected Python environment. Accessible scope may include user-readable files, environment variables, deployment source files, and credentials available to ...[truncated 246 chars]

Remediation
View remediation

Remediation Suggestions

  • Install the CLI in an isolated environment using pipx or a dedicated virtual environment.
  • Pin huggingface_hub and all transitive dependencies to reviewed exact versions.
  • Use a locked requirements file with hashes and install with pip install --require-hashes.
  • Prefer verified binary wheels from the expected package index and avoid unreviewed source builds.
  • Explicitly specify and validate the trusted Python package index.
  • Run installation as an unprivileged user and never use system-level sudo pip.
  • Separate dependency installation from credential entry, and verify the installed package artifact before running hf auth login.
  • Establish a controlled process for reviewing and updating pinned dependencies.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The documentation explicitly presents a publish path using '--no-check', which disables type checking before sending content to a public URL. In a skill that transforms user-controlled data into web content, encouraging or normalizing validation bypass increases the risk of malformed, unsafe, or policy-violating pages being published without safeguards.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

For sensitive/temporary data, always set a TTL:

claw2ui publish --spec-file /tmp/claw2ui_page.ts --title "Dashboard" --ttl 3600000

Skip type checking for faster publish (not recommended):

claw2ui publish --spec-file /tmp/claw2ui_page.ts --title "Dashboard" --no-check

text

Outputs the public URL.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

Listing '--no-check' as a standard publish command exposes a straightforward way to bypass validation in a tool that can publish arbitrary content publicly. Even if type checking is not a complete security control, advertising a validation-bypass parameter as a normal option weakens defense-in-depth and makes misuse easier in automated agent flows.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
# Publish
claw2ui publish --spec-file <file.ts> --title "Title"    # From TS DSL (type-checked)
claw2ui publish --spec-file <file.ts> --no-check         # Skip type checking
claw2ui publish --spec-file <file.json> --title "Title"  # From JSON spec (legacy)
claw2ui publish --html "<h1>Hi</h1>" --title "Test"      # Raw HTML
claw2ui publish --spec-file <file> --style anthropic     # With theme

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: claw2ui
description: 'Generate interactive web pages (dashboards, charts, tables, reports) and serve them via public URL. Use this skill when the user explicitly asks for data visualization, dashboards, analytics reports, comparison tables, status pages, or web-based content. Also triggers for: "draw me a chart", "make a dashboard", "show me a table", "generate a report", "visualize this data", "render this as a page", "publish a page", "claw2ui". If the response would benefit from charts, sortable tables, or rich layout, **suggest** using Claw2UI and wait for user confirmation before publishing. Chinese triggers: "做个仪表盘", "画个图表", "做个报表", "生成一个页面", "做个dashboard", "数据可视化", "做个网页", "展示数据", "做个表格", "做个图", "发布一个页面", "做个看板". Additional English triggers: "create a webpage", "show analytics", "build a status page", "make a chart", "data overview", "show me stats", "create a board", "render a page", "comparison chart", "trend analysis", "pie chart", "bar chart", "line chart", "KPI dashboard", "metrics overview", "weekly report", "monthly report".'
license: MIT
metadata:
  openclaw:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest includes a very broad set of trigger phrases such as 'create a webpage', 'show analytics', and 'make a chart', which can cause the skill to activate for common requests well beyond a narrowly scoped publish workflow. Because this skill publishes content to a public URL and writes persistent auth state, over-triggering increases the chance of unintended invocation, unnecessary data exposure, or the agent steering users toward public publication when a local/plain-text answer would suffice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.