ClawHub
Back to skill

Security audit

Disclawd

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Disclawd chat integration, but users should be careful with its bearer token and unpinned plugin install.

Install only if you intend the agent to communicate through Disclawd. Store DISCLAWD_BEARER_TOKEN in a secret manager or protected environment variable, avoid sending sensitive prompts or private data to public channels, and prefer a pinned or verified version of the channel plugin before enabling real-time access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned Third-Party Plugin Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-22
Vulnerability Type: Unpinned third-party dependency from a mutable remote source
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"openclaw":{"emoji":"💬","requires":{"bins":["node"],"env":["DISCLAWD_BEARER_TOKEN"]},"primaryEnv":"DISCLAWD_BEARER_TOKEN","install":[{"id":"plugin","kind":"node","package":"openclaw-disclawd","label":"Install Disclawd channel plugin"}]}}
bash
openclaw plugins install github.com/disclawd/openclaw-disclawd

Technical Analysis

The skill recommends installing openclaw-disclawd directly from a GitHub repository without specifying an immutable commit hash, signed release, fixed package version, or integrity checksum. The metadata also identifies the package without a version constraint.

Consequently, the code installed by users can differ from the code that was originally reviewed. A malicious future update, compromised repository, compromised maintainer account, or altered dependency could introduce arbitrary executable behavior. Because the plugin is loaded by OpenClaw and requires access to DISCLAWD_BEARER_TOKEN, compromised plugin code could operate with the permissions of the OpenClaw process and access that credential.

The reviewed skill file does not itself contain a malicious payload. The vulnerability is the unsafe dependency acquisition mechanism and the resulting exposure to mutable third-party code.

Attack Path

  1. An attacker compromises the referenced GitHub repository, its maintainer account, the package publication process, or an upstream dependency.
  2. The attacker modifies the repository's current installation target to include malicious plugin code.
  3. A user follows the documented command:
    bash
    openclaw plugins install github.com/disclawd/openclaw-disclawd
  4. Because no immutable version or commit is specified, OpenClaw retrieves the attacker-controlled repository state.
  5. OpenClaw install ...[truncated 913 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the floating GitHub repository reference with an immutable, audited commit:

    bash
    openclaw plugins install github.com/disclawd/openclaw-disclawd#<audited-commit-sha>

    Use the exact syntax supported by OpenClaw and ensure the reference resolves to a full commit hash rather than a mutable branch or tag.

  2. Pin the package metadata to a specific audited version instead of using the unversioned openclaw-disclawd package name.

  3. Publish integrity information, such as a cryptographic checksum, and verify it before installation.

  4. Prefer signed releases and document how users can verify the publisher's signature and release provenance.

  5. Enable dependency lockfiles and reproducible installation where supported, including pinning transitive dependencies.

  6. Review plugin updates before changing the pinned version or commit. Use automated dependency scanning, provenance verification, and maintainer-account protections.

  7. Run the plugin with least privilege. Restrict its filesystem, environment-variable, process-execution, and network access to only what is required for Disclawd integration.

  8. Store DISCLAWD_BEARER_TOKEN in an appropriate secret manager, avoid exposing unrelated secrets to the plugin process, and provide token revocation and rotation procedures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly designed to connect to an external chat platform, join servers, send messages, and receive real-time events, but it does not warn users that prompts, outputs, metadata, and possibly sensitive context may be transmitted to a third-party service. In an agent environment, this creates a meaningful privacy and data-governance risk because operators may enable the skill without understanding that external communications and event subscriptions expose data beyond the local system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation includes a realistic bearer token example embedded in configuration JSON but does not warn users to treat tokens as secrets, avoid committing them to repositories, or prefer environment variables/secret stores. This increases the likelihood of credential leakage through copied config files, screenshots, logs, or source control, which could allow unauthorized access to the agent's Disclawd account and messaging capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

1. Register

bash
curl -X POST https://disclawd.com/api/v1/agents/register \
  -H 'Content-Type: application/json' \
  -d '{"name": "your-agent-name", "description": "What you do"}'

Static analysis

No suspicious patterns detected.