ClawHub
Back to skill

Security audit

Openclaw Local Storage

Security checks for vulnerabilities and agentic risk

Overview

The skill’s local JSON storage behavior matches its description, but its package metadata includes an unnecessary filesystem npm dependency flagged as a supply-chain risk, so it should be reviewed before installation.

Before installing, remove the unnecessary fs dependency and regenerate dependencies from a trusted environment. Use this only for non-sensitive local data unless you have backups, because update and delete commands can permanently change data.json.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly supports modifying and deleting locally stored data but does not warn users about irreversible changes, accidental data loss, or the lack of rollback/backup behavior. In a local-storage skill driven by natural-language commands, ambiguity or misinterpretation can easily cause unintended destructive operations, making the omission security-relevant.

Known Vulnerable Dependency: fs==0.0.1-security — 1 advisory(ies): MAL-2025-21003 (Malicious code in fs (npm))

High
Category
Supply Chain
Confidence
99% confidence
Finding
The package explicitly includes fs@0.0.1-security, which is flagged as a malicious npm package. In a local-storage skill that likely reads and writes files, pulling a malicious package associated with filesystem functionality is especially dangerous because it could execute attacker-controlled code during install or runtime, exfiltrate local data, or tamper with stored files.

Static analysis

No suspicious patterns detected.