ClawHub
Back to skill

Security audit

AgentReach

Security checks for vulnerabilities and agentic risk

Overview

The kit is mostly a marketing and publishing helper, but its one-click publish script can publish the wrong directory and its recurring bounty instructions are under-scoped.

Review this package carefully before installing or following its quick-start commands. Do not run the publish script unless you inspect and harden it, confirm the exact directory being published, and understand which ClawHub account will be used. Treat the heartbeat/cron guidance as an opt-in persistent automation and add limits or cleanup instructions before enabling it.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish-to-clawhub.sh:4
Finding

Failed Directory Validation Can Publish an Unintended Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/publish-to-clawhub.sh, lines 4–16
Vulnerability Type: Improper input validation, incorrect shell quoting, and unchecked directory change
Risk Level: High

bash
SKILL_DIR=$1
SLUG=${2:-$(basename $SKILL_DIR)}
NAME=${3:-$SLUG}
VERSION=${4:-1.0.0}
CHANGELOG=${5:-\"Quick publish\"}

if [ -z \"$SKILL_DIR\" ]; then
  echo \"Usage: $0 <skill-dir> [slug] [name] [version] [changelog]\"
  exit 1
fi

cd $SKILL_DIR
clawhub publish . --slug $SLUG --name \"$NAME\" --version $VERSION --changelog \"$CHANGELOG\"

Technical Analysis

The backslashes before the double quotes cause the quote characters to be treated as literal data rather than shell syntax. Consequently, the condition:

bash
[ -z \"$SKILL_DIR\" ]

does not safely test whether SKILL_DIR is empty. When the variable is empty, the tested value still contains literal quote characters, so the script can continue instead of displaying the usage message and terminating.

The subsequent command uses an unquoted path:

bash
cd $SKILL_DIR

If SKILL_DIR is empty, cd can change to the invoking user's home directory. If the path is invalid, contains whitespace, or expands unexpectedly, cd can fail or target the wrong directory. Because the script neither checks the exit status nor enables fail-fast behavior, it proceeds to execute:

bash
clawhub publish .

This publishes whichever directory is current at that point rather than necessarily publishing the directory requested by the user.

Attack Path

  1. A user invokes the advertised publication script without an argument, with a malformed argument, or with a nonexistent directory.
  2. The incorrectly quoted empty-value test fails to terminate the script.
  3. cd changes to the user's home directory or fails while leaving the process in its original working directory.
  4. The script does not inspect the ...[truncated 678 chars]
Remediation
View remediation

Remediation Suggestions

  • Enable strict shell behavior with set -euo pipefail.
  • Test the first argument through "${1:-}" before assigning or using it.
  • Quote all path expansions and use -- to terminate options.
  • Verify that the target exists and is a directory.
  • Abort explicitly if the directory change fails.
  • Consider resolving the target to a canonical path and presenting it for confirmation before publication.

Example hardened implementation:

bash
#!/usr/bin/env bash
set -euo pipefail

if [[ -z "${1:-}" ]]; then
  printf 'Usage: %s <skill-dir> [slug] [name] [version] [changelog]\n' "$0" >&2
  exit 1
fi

SKILL_DIR=$1

if [[ ! -d "$SKILL_DIR" ]]; then
  printf 'Error: not a directory: %s\n' "$SKILL_DIR" >&2
  exit 1
fi

cd -- "$SKILL_DIR" || exit 1

The script should also confirm the resolved publication directory immediately before invoking clawhub publish.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish-to-clawhub.sh:4
Finding

Unquoted User-Controlled Values Can Alter ClawHub CLI Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/publish-to-clawhub.sh, lines 4–7 and 15–16
Vulnerability Type: Unsafe shell expansion and argument injection
Risk Level: Medium

bash
SKILL_DIR=$1
SLUG=${2:-$(basename $SKILL_DIR)}
NAME=${3:-$SLUG}
VERSION=${4:-1.0.0}
CHANGELOG=${5:-\"Quick publish\"}

cd $SKILL_DIR
clawhub publish . --slug $SLUG --name \"$NAME\" --version $VERSION --changelog \"$CHANGELOG\"

Technical Analysis

Several user-controlled expansions are not shell-quoted:

bash
basename $SKILL_DIR
cd $SKILL_DIR
--slug $SLUG
--version $VERSION

Unquoted expansions undergo shell word splitting and pathname expansion. A directory, slug, or version containing spaces or wildcard characters can therefore produce multiple arguments or expand into local filenames.

The constructs \"$NAME\" and \"$CHANGELOG\" are also unsafe. The backslashes make the quote marks literal characters passed as data; they do not create a quoted shell context. Word splitting and glob expansion can consequently still occur inside the variable values.

A value crafted to contain whitespace followed by option-like text can become additional arguments to clawhub publish. The exact effect depends on the CLI parser, but possible outcomes include corrupted metadata, rejected publications, or alteration of supported command options. This is argument injection rather than direct shell command substitution: command-substitution syntax embedded inside an ordinary variable is not re-evaluated by the shell.

Attack Path

  1. An attacker or untrusted automation supplies a crafted skill-directory name, slug, name, version, or changelog.
  2. The script expands the value without valid shell quoting.
  3. The shell splits the value into multiple words and may expand wildcard characters against local filenames.
  4. The resulting words are passed as separate arguments to basename, cd, or clawhub publish.

...[truncated 721 chars]

Remediation
View remediation

Remediation Suggestions

  • Quote every variable and command-substitution expansion.
  • Pass -- to utilities such as basename and cd where supported.
  • Validate publication fields against restrictive formats.
  • Reject control characters, newlines, and unexpected option prefixes.
  • Use Bash arrays to construct the final command without re-splitting values.

Example:

bash
SKILL_DIR=$1
SLUG=${2:-$(basename -- "$SKILL_DIR")}
NAME=${3:-$SLUG}
VERSION=${4:-1.0.0}
CHANGELOG=${5:-Quick publish}

[[ "$SLUG" =~ ^[A-Za-z0-9._-]+$ ]] || {
  printf 'Invalid slug\n' >&2
  exit 1
}

[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.-]+)?$ ]] || {
  printf 'Invalid version\n' >&2
  exit 1
}

cd -- "$SKILL_DIR" || exit 1

publish_args=(
  publish .
  --slug "$SLUG"
  --name "$NAME"
  --version "$VERSION"
  --changelog "$CHANGELOG"
)

clawhub "${publish_args[@]}"

If clawhub provides an explicit option terminator for metadata values, use it according to the CLI documentation.

T02 · Agent Memory Poisoning

Warning
Location
guides/bounty-hunters.md:17
Finding

Guide Instructs Users to Create Persistent Recurring Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: guides/bounty-hunters.md, lines 17–22
Vulnerability Type: Persistent agent-state modification and recurring task configuration
Risk Level: Medium

markdown
## 3. Pro Hunt (Cron)
Edit `HEARTBEAT.md`:

Check ClawBounty open issues daily.

text
Hunt GH issues: `/gh-issues achilles/openclaw --label bounty`

Technical Analysis

The guide tells the user to edit HEARTBEAT.md and add an instruction that checks external bounty information every day. This changes durable agent state rather than limiting the behavior to the current task or session.

The section is explicitly described as “Cron,” indicating recurring execution. It does not specify an expiration time, removal procedure, repository allowlist, tool restrictions, resource limits, or a requirement to obtain approval before performing subsequent external actions. If the host Agent interprets HEARTBEAT.md as persistent operational instructions, the added rule can continue influencing future sessions.

The content does not itself install a system service or execute a local cron command. The risk depends on the semantics and permissions of the OpenClaw heartbeat mechanism. Nevertheless, it intentionally directs creation of cross-session recurring behavior.

Attack Path

  1. A user follows the bounty-hunting guide.
  2. The user adds Check ClawBounty open issues daily. to HEARTBEAT.md.
  3. The Agent retains and processes the heartbeat instruction across later sessions.
  4. On its recurring schedule, the Agent searches for external bounty or issue information.
  5. The activity continues until the persistent instruction is manually removed or disabled.
  6. If the Agent or associated bounty tools permit actions beyond read-only searching, later activity may use those existing permissions unless separately constrained.

Impact Assessment

The persistent instruction can consume Agent execution time, A ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  • Make persistent heartbeat modification explicitly optional and require informed user consent.
  • Prefer a scoped scheduler entry over modifying general-purpose Agent memory.
  • Define an expiration date, maximum execution count, and documented removal procedure.
  • Restrict the task to approved repositories, domains, and read-only tools.
  • Require confirmation before claiming bounties, submitting changes, sending messages, or initiating payments.
  • Specify rate limits and execution-budget limits.
  • Clearly distinguish a one-time search command from recurring automation.

A safer instruction would state that the user must explicitly opt in, identify the repositories to monitor, approve the schedule, and review each proposed external action before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs users to run a shell script named as a '1-click skill deploy' tool, but provides no disclosure of what commands it executes or what files/services it may modify or publish. In a package marketed for rapid deployment and monetization, this increases the chance that users will run it without review, potentially causing unintended publication, credential misuse, or destructive changes.

Content

No source excerpt is available for this finding.