ClawHub
Back to skill

Security audit

WhatsApp & Calls

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently connects OpenClaw to 2Chat so an agent can use WhatsApp/SMS features, with the main risks being normal messaging/account access that users should approve carefully.

Install only if you trust 2Chat with the WhatsApp/SMS account data involved. Review message recipients and bodies before approving sends, and be careful with contact deletion, status publishing, and channel commands because they affect real accounts and may cost money.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
2chat-whatsapp/PUBLISH.md:19
Finding

Unpinned Global Installation of a Third-Party Publishing Tool

Content
View full analysis

Vulnerability Details

File Location: 2chat-whatsapp/PUBLISH.md:19-21
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code:

bash
npm i -g clawhub
# or: pnpm add -g clawhub

Technical Analysis

The publishing instructions install the latest available version of the clawhub npm package globally without pinning an exact version or verifying package integrity. Because the resolved package can change over time, users following the same instructions may execute code that was not present or reviewed when this Skill was audited.

npm packages can define lifecycle scripts that execute during installation. A compromised package, malicious future release, or compromised transitive dependency could therefore run arbitrary commands under the privileges of the user performing the installation. Global installation also places executables in shared system or user-level locations, increasing the potential scope of package tampering.

This finding is limited to the publishing workflow documented in PUBLISH.md; the Skill itself does not automatically run this installation command.

Attack Path

  1. An attacker compromises the clawhub npm package, one of its transitive dependencies, or its publishing account.
  2. The attacker publishes a malicious version that becomes the version selected by the unpinned install command.
  3. A maintainer follows the documented npm i -g clawhub or pnpm add -g clawhub instruction.
  4. The package manager downloads the mutable latest release without a repository-controlled lockfile or explicit integrity validation.
  5. Malicious package code or lifecycle scripts execute with the maintainer's current privileges.
  6. The compromised tool may steal publishing credentials, modify files, tamper with globally installed commands, or publish altered Skill artifacts.

Impact Assessment

Successful exploitation could obtain ...[truncated 671 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the publishing tool to a reviewed exact version, for example clawhub@1.2.3, rather than resolving the latest release.
  • Prefer a repository-local development dependency recorded in package.json and protected by a committed lockfile.
  • Use deterministic installation such as npm ci in controlled publishing environments.
  • Verify the package source, published integrity hash, signatures, and provenance before upgrading.
  • Avoid global installation where possible; invoke the pinned local executable through a package script.
  • Disable package lifecycle scripts with --ignore-scripts when the tool supports installation without them.
  • Run publication from an isolated, least-privileged environment with narrowly scoped, short-lived credentials.
  • Document a controlled dependency-update process that reviews release notes and package changes before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .clawhubignore (reported line 5)May include surrounding context.

text
.DS_Store
Thumbs.db
*.log
.env
.env.*
node_modules/
.git/

Static analysis

No suspicious patterns detected.