ClawHub
Back to skill

Security audit

OpenClawCash

Security checks for vulnerabilities and agentic risk

Overview

This is a deprecated placeholder that points users to a replacement skill and contains no executable code, though users should verify the replacement before installing it.

Before installing the replacement OpenClawCash skill, review its current package, publisher, permissions, and version because this legacy placeholder does not pin or audit the replacement content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned External Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-27
Vulnerability Type: Unverified and mutable external dependency
Risk Level: Medium

Vulnerable Code

text
Use the current OpenClawCash skill instead:
https://clawhub.ai/macd2/open-claw-cash

Do not continue setup with this legacy copy.
Install the replacement skill from the URL above and follow its current instructions.

Technical Analysis

The Skill instructs users or agents to install and follow a replacement Skill hosted at an external URL. The reference does not specify an immutable version, cryptographic digest, verified signature, or locally auditable copy.

Consequently, the effective replacement content may change after this artifact has been reviewed. If the external account, hosting service, publication workflow, or referenced Skill is compromised, the replacement could supply instructions or executable components that were not covered by this audit.

The reviewed file does not itself retrieve or execute remote code, and there is no evidence that the referenced replacement is malicious. The issue is an insecure supply-chain trust boundary caused by directing installation from a mutable, unpinned source.

Attack Path

  1. An attacker compromises the publisher account, external hosting platform, or replacement Skill's release process.
  2. The attacker modifies the replacement Skill or its instructions while retaining the same URL.
  3. A user or agent follows the directive in SKILL.md and installs the externally hosted replacement.
  4. The replacement is loaded with the tools and permissions available to the agent.
  5. Malicious replacement content may then misuse those capabilities without having been assessed as part of this audit.

Impact Assessment

The vulnerable artifact grants no privileges directly and contains no executable scripts. Potential impact depends on the replacement Skill and the permissions availabl ...[truncated 415 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reference an immutable, explicitly approved release of the replacement Skill rather than a mutable landing-page URL.
  2. Record and verify a cryptographic digest for the exact replacement package before installation.
  3. Require publisher or package-signature verification through a trusted signing mechanism.
  4. Vendor a reviewed copy into a controlled repository when feasible, preserving its provenance and license information.
  5. Require a fresh security review whenever the replacement version or digest changes.
  6. Prevent agents from automatically installing or following externally hosted Skill instructions without explicit user approval.
  7. Install the replacement under least privilege, restricting credential access, filesystem access, network destinations, and executable tools to those strictly required.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.