ClawHub
Back to skill

Security audit

Agent Relay

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent phone-to-agent relay, but its public webhook setup can automatically wake an agent with broad tools and the authentication guidance is under-scoped.

Review before installing. Only use this if you intend phone messages and attachments to pass through the relay service and into an agent session. Replace all personal defaults, use your own relay URL and credentials, require a strong webhook secret or equivalent validation before the request reaches OpenClaw, restrict the public endpoint, set attachment storage limits, and keep cron polling disabled unless you need the fallback.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The webhook section documents immediate POST delivery of user messages and attachment metadata, including time-limited download URLs, to an externally configured endpoint, but it does not explicitly warn that enabling this feature transmits user content off-platform to a public host. In a relay skill whose purpose is bridging agent-user communications, this omission can lead operators to enable push delivery without fully understanding the privacy and data-exposure implications, increasing the chance of accidental disclosure to third-party infrastructure or improperly secured webhook handlers.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The webhook section documents immediate delivery of user messages and attachment download links to an externally configured endpoint, but it does not clearly warn that this forwards potentially sensitive user content outside the relay service boundary. In this skill context, that omission is meaningful because the feature is specifically designed to bridge private phone communications to third-party agent infrastructure, increasing the risk of unintentional data exposure or unsafe deployments.

Static analysis

No suspicious patterns detected.