Openclaw Workspace Governance Installer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:33 PM UTC
• Version: 0.2.9

Overview

This skill is a transparent installer guide for a workspace-governance plugin, but users should treat its unpinned external plugin install as a supply-chain caution.

Before installing, review the linked plugin source and consider using a pinned, reviewed version instead of @latest. Install only if you trust the publisher and are comfortable granting a governance plugin authority to modify OpenClaw workspace configuration and related governance files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–22
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code:

bash

# 1) Install plugin
openclaw plugins install @adamchanadam/openclaw-workspace-governance@latest
openclaw gateway restart

Technical Analysis

The installation command uses the mutable @latest version tag. Consequently, the package resolved when a user runs this command may differ from the version that existed when the Skill was reviewed. The project contains only SKILL.md; it does not include the plugin source, a cryptographic digest, a signature, or a lock file through which the downloaded artifact could be authenticated.

The subsequent gateway restart activates the newly installed component. Although the documented installation is intentional and no malicious implementation is present in the supplied artifact, the instructions create a supply-chain trust boundary that cannot be verified through this repository alone.

Attack Path

1. An attacker compromises the package publisher account, package registry, or upstream release process.
2. The attacker publishes a modified package as the version selected by @latest.
3. A user follows the documented quick-start command.
4. OpenClaw downloads and installs the attacker-controlled plugin.
5. The user restarts the gateway as instructed, activating the compromised component.
6. The component executes with whatever workspace and configuration privileges the OpenClaw plugin runtime grants it.

Impact Assessment

A compromised dependency could perform actions available to an OpenClaw plugin. Based on the documented plugin functions, the relevant scope may include workspace governance files and openclaw.json; however, the exact permissions cannot be established because the plugin implementation is absent from the audited project.

Potential consequences include unauthori ...[truncated 268 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed plugin version.
2. Verify the downloaded artifact using a published cryptographic digest or trusted package signature before activation.
3. Document the authoritative registry and source repository, and require a trusted publisher identity.
4. Include or vendor the applicable plugin source in the audited release so its behavior can be reviewed.
5. Use a lock file or equivalent immutable dependency manifest where supported.
6. Perform installation in a least-privileged environment and review requested plugin permissions before restarting the gateway.
7. Establish a controlled update process with release review, integrity verification, testing, and rollback procedures rather than automatically selecting the newest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.