ClawHub
Back to skill

Security audit

Clawnexus

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent OpenClaw discovery purpose, but it asks users to install and start an unpinned global daemon that scans the LAN and stores discovered instance data with limited scope and retention guidance.

Install only if you trust the ClawNexus npm package and publisher. Prefer a pinned, reviewed version, do not run the install with sudo/admin rights, run scans only on networks where you have permission, and treat `~/.clawnexus/registry.json` as local network metadata that may need to be cleared when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash
## Prerequisites

```bash
# Install and start the daemon
npm install -g clawnexus
clawnexus start

Technical Analysis

The skill instructs users to install the latest available release of the third-party clawnexus npm package globally without specifying an exact version, lockfile, integrity hash, or provenance verification procedure. Because npm package versions and distribution tags are mutable from the consumer's perspective, the installed code may differ from the version reviewed when this skill was published.

npm installations can also execute package lifecycle scripts with the privileges of the invoking user. The instructions immediately start the newly installed daemon, further exposing the host to any malicious or unexpectedly changed behavior in the retrieved package.

Attack Path

  1. An attacker compromises the npm publisher account, publishing pipeline, or package distribution channel for clawnexus.
  2. The attacker publishes a malicious release or changes the package's latest distribution tag to point to one.
  3. A user follows the documented npm install -g clawnexus instruction.
  4. npm retrieves the attacker-controlled release and may execute its lifecycle scripts with the user's privileges.
  5. The user runs clawnexus start, executing and potentially persisting the malicious daemon.
  6. The payload can access resources available to the user and interact with local or LAN services.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npm. The resulting scope may include reading or modifying user-accessible files, accessing environment data, interacting with local and LAN services, opening network listeners, or ...[truncated 242 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact reviewed version, for example:
    bash
    npm install -g clawnexus@0.4.0
  • Verify that the pinned package version corresponds to the reviewed source revision and expected publisher.
  • Publish and document package integrity and provenance verification, such as npm provenance attestations and a trusted checksum.
  • Review package lifecycle scripts before recommending installation.
  • Prefer a project-local or otherwise isolated installation over a global installation where operationally feasible.
  • Avoid elevated privileges and document that the installation must not be run with sudo or as an administrator.
  • Establish an explicit update and security-review process rather than automatically consuming the latest release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Check a specific instance (by alias, auto_name, or address:port)

bash
curl -s http://localhost:17890/instances/home
curl -s http://localhost:17890/instances/olivia
curl -s http://localhost:17890/instances/192.168.1.10:18789

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly instructs triggering a LAN scan but does not warn that this will probe other devices on the local network and may have privacy, policy, or operational impact. In a security-sensitive environment, encouraging unaudited network discovery can expose device metadata and cause the agent to perform actions the user did not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill notes that ClawNexus persists a registry to ~/.clawnexus/registry.json but does not warn that device identifiers, aliases, addresses, and status history may remain stored on disk. This creates a privacy and data-retention risk, especially on shared systems or endpoints with weak file-permission hygiene.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.