ClawHub
Back to skill

Security audit

GovernClaw Policy Enforcer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a governance HTTP wrapper, but it gives a configurable policy service under-disclosed access to request contents and the ability to rewrite allowed HTTP requests.

Review this before installing. It may be appropriate only if you fully trust and control the GovernClaw policy service configured by GOVERNCLAW_URL, avoid sending secrets through governedHttp unless that service is authorized to see them, and understand that the current artifact only implements HTTP governance, not shell, file, or browser governance.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
index.ts:8
Finding

Sensitive HTTP Request Data Is Disclosed to a Configurable Policy Endpoint

Content
View full analysis
{ try { const response = await axios.post( GOVERNCLAW_GOVERN_URL, request, { headers: { "Content-Type": "application/json" }, timeout: 10000, // 10 second timeout for policy decision } ); return response.data; } catch (error) { if (error instanceof AxiosError) { const message = error.response?.data?.detail || error.message; throw new Error(`GovernClaw request failed: ${message}`); } throw error; } } ``` ```typescript const { method, url, body, headers } = params; // Build the governance request const governRequest = buildGovernClawRequest( context, "http", `OpenClaw HTTP ${method} to ${url}`, { url, method, body, headers } ); // Query GovernClaw for policy decision const decision = await queryGovernClaw(governRequest); ``` ### Technical Analysis The middleware sends the complete target URL, HTTP method, request body, and request headers to the service specified by `GOVERNCLAW_URL`. The governance request also includes session and agent identifiers generated by `buildGovernClawRequest`. Headers and request bodies commonly contain sensitive values such as: - `Authorization` bearer tokens - API keys - Session cookies - Personal or regulated information - Private application payloads - Internal hostnames and resource identifiers The destination is selected through an ...[truncated 1883 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
index.ts:136
Finding

Unvalidated Policy Response Can Replace and Redirect an Approved HTTP Request

Content
View full analysis
| undefined, }); return result; ``` ### Technical Analysis After the policy service returns an `allow` decision, the middleware permits `decision.effective_payload` to replace the original URL, method, body, and headers. The replacement is passed directly to the underlying HTTP tool. The TypeScript assertions do not perform runtime validation. Consequently, the code does not verify that: - The effective URL matches the URL reviewed and requested by the caller. - The hostname, scheme, port, and path remain within an approved destination. - The effective method is one of the tool's documented methods. - Sensitive headers have not been added, modified, or redirected. - The replacement body still represents the caller's intended operation. - The response object has a valid and expected schema. - A material transformation has been disclosed to or approved by the caller. The behavior also exceeds the simple allow-or-block workflow documented in `SKILL.md`. A caller may therefore believe that its original request will execute after approval while the policy service can cause a materially different operation. This creates a tool-hijacking trust boundary: compromise or malicious configuration of the policy service converts an apparently governed HTTP call into an attacker-directed HTTP primitive. ### Att ...[truncated 2001 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill advertises governance coverage for HTTP, shell, file, and browser actions, but the documented exposed functionality only implements HTTP governance while marking the others as future work. This mismatch is dangerous because users may assume sensitive shell, file, or browser actions are policy-enforced when they are not, creating a false sense of security around high-risk operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares network and environment-backed behavior but does not explicitly scope or constrain its required capabilities with a permissions/allowed-tools declaration. In a security-sensitive middleware skill, this ambiguity can lead operators or downstream agents to over-trust the wrapper and unintentionally grant broader access than intended.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

typescript
const result = await context.tools.governclawMiddleware.governedHttp({
  method: "GET",
  url: "https://api.example.com/data"
});

if (result.blocked) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill states that session, agent, source, channel, and node metadata are automatically forwarded to GovernClaw, but it does not clearly present this as external data sharing or discuss sensitivity, retention, or trust boundaries. In governance middleware, this context can reveal user/session relationships and internal topology, so silent or under-emphasized transmission increases privacy and information exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends the full governance request, including URL, method, body, headers, and context-derived identifiers, to the GovernClaw service via axios.post. Although the file contains internal comments and a tool description, it does not provide a clear user-facing warning that request data may be transmitted to an external/local policy service before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The governed tool ultimately performs outbound HTTP requests using the provided or policy-modified URL, body, and headers. While the tool description says it makes HTTP requests through a policy engine, it does not explicitly warn users that supplied payloads and headers may be sent to external APIs, which is a privacy-relevant behavior for a general-purpose HTTP wrapper.

Content

No source excerpt is available for this finding.