T01 · Skill Instruction Hijacking
Error
- Location
src/daemon/server.ts:282- Finding
Untrusted P2P Message Content Is Forwarded Directly into OpenClaw Agent Events
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawChat - P2P Agent Communication
Security checks for vulnerabilities and agentic risk
Overview
ClawChat appears to be a legitimate agent-to-agent chat tool, but its default remote access and wake behavior can let outside peers influence an OpenClaw agent too broadly.
Review before installing. Use an explicit allowlist instead of ["*"], disable openclawWake unless you trust every sender, treat all received message content as untrusted, avoid passing seed phrases or passwords on the command line, restrict data-directory and socket permissions, and prefer pinned/local package execution. I did not find artifact-backed deception, exfiltration, or intentionally destructive behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/net/snap2p-protocol.ts:196- Finding
Authenticated Principal Is Not Bound to the Principal in the Signed Attestation
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/net/snap2p-protocol.ts:308- Finding
Chat Message Sender Is Not Bound to the Authenticated Session Identity
- Content
View full analysis
{ while (!this.closed && this.authenticated) { try { const msg = await this.waitForMessage(); if (msg.type === MessageType.STREAM_DATA) { const chatMsg = decodeChatMessage(msg.data as Uint8Array); this.emit('message', chatMsg); } else if (msg.type === MessageType.PING) { this.sendMessage(createPongMessage(msg.nonce as Uint8Array)); } } catch (err) { if (!this.closed) { this.emit('error', err); } break; } } }; processMessages(); } ``` The decoded sender is subsequently trusted by the daemon: ```ts const message: Message = { id: msg.id, from: msg.from, fromNick: msg.nick, to: recipientPrincipal, content: msg.content, timestamp: msg.timestamp, status: 'delivered', }; // Route message with ACL enforcement const result = this.messageRouter.routeInbound(message, msg.from); ``` ### Technical Analysis The SNaP2P session has an authenticated principal available through `session.remote`. However, the message loop decodes a separate `from` value from peer-controlled application data and emits it without validating that it equals the authenticated principal. The daemon then uses `msg.from`, rather than `session.remote`, as both the stored sender and the principal supplied to `routeInbound()`. Therefore, message-level authorization and attribution are based on attacker-controlled data. This is independent of the authentication-field mismatch described separately. Even if session authentication is corrected, any validly authenticated peer could still forge the `from` field of an allowlisted principal unless the message is bound to the sess ...[truncated 1044 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/daemon/gateway-config.ts:211- Finding
Gateway Initialization Enables Wildcard Remote Access and Agent Wake by Default
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/daemon/server.ts:184- Finding
Local IPC Socket Commands Lack Explicit Authorization and Socket Permission Hardening
- Content
View full analysis
{ this.handleIpcConnection(socket); }); this.ipcServer.listen(socketPath); ``` Commands received from the socket are executed without an authentication step: ```ts const cmd = JSON.parse(line) as IpcCommand; const response = await this.handleIpcCommand(cmd); socket.write(JSON.stringify(response) + '\n'); ``` Examples of privileged operations exposed by the handler include: ```ts case 'send': { const sourceIdentity = this.getIdentityForCommand(cmd.as); // ... await this.tryDeliver(message); return { ok: true, data: { id, status: 'queued' } }; } ``` ```ts case 'peer_add': { // ... this.identityManager.addOrUpdatePeer(identity.identity.principal, peer); this.identityManager.savePeers(identity.identity.principal); return { ok: true, data: peer }; } ``` ```ts case 'stop': await this.stop(); return { ok: true, data: { status: 'stopping' } }; ``` ### Technical Analysis The Unix-domain socket is created without an explicit restrictive mode, and the server does not verify peer credentials or require an IPC authentication token. The command handler also does not enforce the identity configuration's `allowLocal` property, despite the presence of an `isLocalAccessAllowed()` helper elsewhere in the codebase. Security therefore depends on ambient filesystem permissions and process umask. If another local account or process can access the socket, it can submit arbitrary newline-delimited JSON commands. Loaded identities are already decrypted in daemon memory, so no identity password is required for these operations. The interfac ...[truncated 1396 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (111)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Showing a 24-word seed phrase as a command-line argument is especially dangerous because recovery phrases are wallet-equivalent secrets and may be captured in shell history, logs, telemetry, or process inspection. Anyone obtaining that phrase can fully recover the identity and associated assets or communications identity.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash clawchat identity recover \ --mnemonic-file /path/to/seedphrase.txt \ --password-file /path/to/password.txtDaemon
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash launchctl unload ~/Library/LaunchAgents/com.clawchat.daemon.plist rm ~/Library/LaunchAgents/com.clawchat.daemon.plistUsing Multiple Identities
Known Vulnerable Dependency: nanoid==5.1.6 — 2 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The lockfile pins nanoid 5.1.6 under @libp2p/circuit-relay-v2, and the cited advisories indicate denial-of-service/integer handling flaws in nanoid size processing. This is a real supply-chain risk, but in this file the package is a transitive dependency and there is no evidence the project directly passes attacker-controlled negative or zero sizes, so practical exploitability from this file alone is limited.
- Content
Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
lodash 4.17.23 is present and has well-known classes of issues including prototype pollution and template/code-injection in specific APIs. This is a true vulnerable dependency, though whether it is exploitable depends on the application invoking unsafe functions like _.unset on attacker-controlled paths or _.template on untrusted input, which cannot be confirmed from the lockfile alone.
- Content
Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
nanoid 3.3.11 appears in a dev/build dependency path via postcss and carries advisories around edge-case size handling and looping behavior. This is a genuine vulnerable version, but because it is in development tooling and not obviously part of runtime processing for this skill, the security impact in deployed use is lower unless untrusted build-time inputs are processed.
- Content
Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
postcss 8.5.6 is present only as a dev dependency in the frontend/build toolchain, and the listed advisories include file-read, sourcemap, and output-escaping issues. The dependency is genuinely vulnerable, but from this lockfile context it appears build-time only, which reduces exposure unless the project processes attacker-supplied CSS or source maps during builds.
- Content
Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
rollup 4.57.1 is included as a development/build dependency, and an arbitrary file write via path traversal advisory is plausibly serious when build inputs are attacker-controlled. However, in this package-lock context there is no evidence of hostile plugin/input handling at runtime, so the issue is real but mainly affects development or CI environments rather than end-user execution.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
Usage Examples
Send Message to Another Agent
bash # Send dinner poll update to Peter's agent
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Incoming network messages can cause the daemon to invoke an external program (
openclaw) with attacker-controlled content embedded in the--textargument. Even without shell injection, this creates an unintended remote-triggered side effect outside the chat daemon's core purpose, enabling spammy or abusive local system event generation and expanding trust from remote peers into local process execution.- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md allowLocal: boolean; /** * Remote peers allowed to send messages to this identity * Use ["*"] for all peers, or list specific principals */ allowedRemotePeers: string[];
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md allowLocal: boolean; /** * Remote peers allowed to send messages to this identity * Use ["*"] for all peers, or list specific principals */ allowedRemotePeers: string[];
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
ts allowLocal: boolean; /** * Remote peers allowed to send messages to this identity * Use ["*"] for all peers, or list specific principals */ allowedRemotePeers: string[];
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
ts allowLocal: boolean; /** * Remote peers allowed to send messages to this identity * Use ["*"] for all peers, or list specific principals */ allowedRemotePeers: string[];
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The quick-start instructs users to execute
npx clawchatwithout pinning an exact package version. This can cause users to fetch and run whatever version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This command uses
npx clawchatwithout a pinned version, so execution depends on the latest package resolution at runtime. That exposes users to unintended code execution from a changed, hijacked, or compromised npm release.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The documentation tells users to run
npx clawchatwithout fixing the package version. In security-sensitive tooling, this creates a supply-chain exposure because the executed package may differ over time and may not match what was audited.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Using
npx clawchatunpinned in peer-management instructions means users may execute an unreviewed package version during setup. Because these commands establish network connectivity, a compromised package could abuse trust during onboarding.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The send-message example relies on an unpinned
npxpackage invocation. That introduces avoidable remote code execution risk via npm package substitution or release compromise, especially since users are encouraged to run it directly from docs.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The receive-message command uses
npx clawchatwithout a fixed version, so the tool executed at runtime may not be the one users expect. This is a classic documentation-driven supply-chain weakness rather than a code bug, but it can still lead to arbitrary code execution on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This identity-management example uses an unpinned package reference via
npx. If the npm package changes or is compromised, users could execute hostile code while handling identity-related operations.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The daemon stop command is shown with
npx clawchatand no version pin. Even routine operational commands become a supply-chain risk when docs encourage fetching executable code dynamically at runtime.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This start command again relies on unpinned
npxexecution, making the quick-start nondeterministic and vulnerable to malicious or accidental upstream package changes. Because the command starts a background daemon, compromise could yield persistent local access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The message-send example for alternate identities uses an unpinned npm execution path. In a security-oriented messaging tool, this is especially risky because users may assume cryptographic operations are trustworthy while actually running an unverified package version.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The troubleshooting command tells users to run
npx clawchatwithout version pinning, repeating the same supply-chain issue. Troubleshooting steps are often copy-pasted quickly, so this increases the likelihood of users executing unreviewed package code.- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal, suspicious.generated_source_template_injection
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/daemon/server.ts:311
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/__tests__/identity.test.ts:107
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/cli.ts:62
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/identity/keys.ts:112
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- skills/clawchat/examples/README.md:46