ClawHub
Back to skill

Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate ZeroID API skill, but it handles powerful identity credentials through a configurable API URL and includes disruptive credential and agent lifecycle commands.

Use this only with a ZeroID server you trust. Before running any command, confirm ZEROID_BASE_URL is the intended HTTPS origin, use the least-privileged ZEROID_API_KEY available, avoid pasting secrets into shell history where possible, and double-check credential IDs or agent IDs before revocation or deactivation because those actions can disrupt downstream access.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:8
Finding

Credential Disclosure Through an Unvalidated Configurable API Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
## 2. Issue Credentials

Exchange OAuth2 client credentials for a short-lived JWT access token. First register an OAuth2 client, then use `client_credentials` grant.

**Register an OAuth2 client:**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
- ZEROID_API_KEY
        - ZEROID_BASE_URL
      bins:
        - curl
    primaryEnv: ZEROID_API_KEY
    emoji: 🔐
    homepage: https://github.com/highflame-ai/zeroid

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents credential revocation and agent deactivation, including cascading invalidation of downstream tokens and deletion-style deactivation, but it does not include a clear caution or warning banner about operational impact or recovery limitations. Because these actions can immediately disrupt agent access and affect downstream systems, the skill description should explicitly warn users before presenting the commands.

Content

No source excerpt is available for this finding.