ClawHub
Back to skill

Security audit

Clawrouter

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and disclosed, but it deserves review because it installs mutable external npm code and stores cryptocurrency signing keys in plaintext for automatic paid requests.

Install only if you are comfortable sending prompts to blockrun.ai and using a dedicated low-balance wallet for automatic per-request payments. Verify the exact npm package version before installing, avoid storing meaningful funds in the generated wallet, and protect the OpenClaw config file as sensitive key material.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Executable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–22 and 81–86
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

json
"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "@blockrun/clawrouter",
      "bins": ["clawrouter"],
      "label": "Install ClawRouter (npm)",
    },
  ],
bash
openclaw plugins install @blockrun/clawrouter
markdown
The structured `install` block above tells OpenClaw to install the auditable npm package `@blockrun/clawrouter`. Source for every version is on GitHub; every release is tagged.

Technical Analysis

The npm package reference does not specify an exact version or an integrity digest. Installation therefore resolves whichever release the package registry considers current at installation time. GitHub tags and claims that npm versions match releases provide useful review information, but they do not cryptographically bind the installed artifact to a previously audited commit.

The audited project contains only SKILL.md; the package implementation and installation lifecycle scripts are not present. Consequently, the executable behavior of the npm dependency could not be verified within the supplied artifact.

Attack Path

  1. An attacker compromises the npm publisher account, package publishing workflow, or another component of the release supply chain.
  2. The attacker publishes a malicious version of @blockrun/clawrouter.
  3. A user follows the documented command, or OpenClaw processes the structured installation declaration without an exact version constraint.
  4. npm resolves and installs the attacker-controlled release.
  5. Malicious installation lifecycle code or plugin runtime code executes with the privileges of the OpenClaw user.
  6. That code may access user-readable files, OpenClaw configuration, prompts handled by the plugin, and plaintext wallet keys.

Impact Assessment

Successful expl ...[truncated 617 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version, such as @blockrun/clawrouter@x.y.z.
  • Record and verify the registry-provided integrity hash before installation.
  • Use a lockfile or equivalent immutable dependency manifest where supported.
  • Require signed npm provenance and verify that the package was built from the intended repository and commit.
  • Audit package contents and lifecycle scripts before approving each upgrade.
  • Prevent automatic upgrades to newly published versions.
  • Perform installation and execution in a restricted environment with only the filesystem and network permissions required by the plugin.
  • Treat release-tag matching as supporting evidence rather than a substitute for artifact integrity verification.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:55
Finding

Cryptocurrency Private Keys Stored in Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–70
Vulnerability Type: Plaintext storage of financial signing keys
Risk Level: Medium

Vulnerable Code

markdown
**What `models.providers.blockrun` stores (fully enumerated):**

| Field       | Sensitive | Purpose                                                                                                                                                                                                    |
| ----------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `walletKey` | Yes       | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted over the network; only detached payment signatures are sent. |
| `solanaKey` | Yes       | Solana keypair (BIP-44 `m/44'/501'/0'/0'`). Auto-derived from the same local mnemonic via `@scure/bip32` + `@scure/bip39`.                                                                                 |
| `gateway`   | No        | Gateway URL. Defaults: `https://blockrun.ai/api` (Base) · `https://sol.blockrun.ai/api` (Solana).                                                                                                          |
| `routing`   | No        | Optional override of the default four-tier router.                                                                                                                                                         |

**How and where keys are stored:**

- Keys live in the OpenClaw user config file — typically `~/.config/openclaw/config.json` on Linux, `~/Library/Application Support/openclaw/config.json` on macOS, `%APPDATA%\openclaw\config.json` on Windows — under the `models.providers.blockrun` path.
- Written by OpenClaw's standard config writer wi
...[truncated 2833 chars]
Remediation
View remediation

Remediation Suggestions

  • Store private keys in an operating-system credential vault, such as macOS Keychain, Windows Credential Manager/DPAPI, or a Linux Secret Service implementation.
  • Prefer hardware-backed or non-exportable signing keys where protocol support permits.
  • If file storage is unavoidable, encrypt key material with a user-supplied secret and a modern authenticated-encryption scheme; do not store the decryption key beside the ciphertext.
  • Enforce restrictive ownership and permissions on every supported platform and fail closed when secure permissions cannot be established.
  • Exclude wallet material from logs, diagnostics, crash reports, support bundles, backups, and synchronization systems.
  • Use a dedicated low-balance wallet and implement transaction or spending limits where possible.
  • Provide key rotation and emergency fund-migration procedures.
  • Remove compromised keys from configuration and migrate remaining assets immediately after suspected disclosure.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
**What `models.providers.blockrun` stores (fully enumerated):**

| Field       | Sensitive | Purpose                                                                                                                                                                                                    |
| ----------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `walletKey` | Yes       | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted over the network; only detached payment signatures are sent. |
| `solanaKey` | Yes       | Solana keypair (BIP-44 `m/44'/501'/0'/0'`). Auto-derived from the same local mnemonic via `@scure/bip32` + `@scure/bip39`.                                                                                 |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
| Field       | Sensitive | Purpose                                                                                                                                                                                                    |
| ----------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `walletKey` | Yes       | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted over the network; only detached payment signatures are sent. |
| `solanaKey` | Yes       | Solana keypair (BIP-44 `m/44'/501'/0'/0'`). Auto-derived from the same local mnemonic via `@scure/bip32` + `@scure/bip39`.                                                                                 |
| `gateway`   | No        | Gateway URL. Defaults: `https://blockrun.ai/api` (Base) · `https://sol.blockrun.ai/api` (Solana).                                                                                                          |
| `routing`   | No        | Optional override of the default four-tier router.                                                                                                                                                         |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
| ----------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `walletKey` | Yes       | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted over the network; only detached payment signatures are sent. |
| `solanaKey` | Yes       | Solana keypair (BIP-44 `m/44'/501'/0'/0'`). Auto-derived from the same local mnemonic via `@scure/bip32` + `@scure/bip39`.                                                                                 |
| `gateway`   | No        | Gateway URL. Defaults: `https://blockrun.ai/api` (Base) · `https://sol.blockrun.ai/api` (Solana).                                                                                                          |
| `routing`   | No        | Optional override of the default four-tier router.                                                                                                                                                         |

**How and where keys are stored:**

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
| `walletKey` | Yes       | EVM private key used to sign USDC micropayments via x402. **Auto-generated locally on first run** — no user input required. Never transmitted over the network; only detached payment signatures are sent. |
| `solanaKey` | Yes       | Solana keypair (BIP-44 `m/44'/501'/0'/0'`). Auto-derived from the same local mnemonic via `@scure/bip32` + `@scure/bip39`.                                                                                 |
| `gateway`   | No        | Gateway URL. Defaults: `https://blockrun.ai/api` (Base) · `https://sol.blockrun.ai/api` (Solana).                                                                                                          |
| `routing`   | No        | Optional override of the default four-tier router.                                                                                                                                                         |

**How and where keys are stored:**

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
- Every release is tagged on GitHub: https://github.com/BlockRunAI/ClawRouter/releases
- Every release publishes to npm with a matching version: https://www.npmjs.com/package/@blockrun/clawrouter?activeTab=versions
- The `skills/release/SKILL.md` mandatory checklist enforces: same version in `package.json`, matching git tag, matching GitHub release, and matching npm publish.
- To verify locally: `npm pack @blockrun/clawrouter@<version>` and compare the tarball contents to the tagged commit.

## Install

Static analysis

No suspicious patterns detected.