ClawHub
Back to skill

Security audit

openclaw-deal-scout

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent about automating Gmail-to-HubSpot deal handling, but it asks users to install mutable proprietary code from GitHub and give it powerful email and CRM credentials.

Review and pin a specific trusted commit or release before installing, avoid dev extras for normal use, run it under a dedicated low-privilege account, keep the gateway bound to localhost, and grant the narrowest possible Gmail and HubSpot permissions. Use test accounts first and rotate credentials if you previously installed an unreviewed revision.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unpinned Remote Repository Is Retrieved and Executed Locally

Content
View full analysis
Remediation
View remediation
``` 2. Publish signed releases and require verification of the release signature or commit signature before installation. 3. Provide cryptographic checksums for release archives and document an explicit checksum-verification step. 4. Use a fully locked dependency set with hashes, such as a requirements lock file installed with hash enforcement. Review both direct and transitive dependencies. 5. Do not install the `dev` dependency group for normal production use. Provide a minimal runtime installation command containing only required dependencies. 6. Audit packaging metadata and build configuration before installation. Prefer build and installation mechanisms that minimize or isolate arbitrary build-hook execution. 7. Run installation and the gateway under a dedicated, unprivileged operating-system account. Do not install as root or with administrator privileges. 8. Apply least privilege to all service credentials. Restrict Gmail and HubSpot scopes to those strictly necessary, and rotate credentials if an untrusted repository revision has already been installed. 9. Consider publishing reproducible, immutable release artifacts so users can verify that installed code corresponds exactly to the reviewed source. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
python -m venv .venv && source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -e ".[dev]"

cp .env.example .env
# Fill in: GMAIL_CREDENTIALS_PATH, GEMINI_API_KEY, HUBSPOT_PRIVATE_APP_TOKEN,
#          NOTIFIER=discord, DISCORD_WEBHOOK_URL

Static analysis

No suspicious patterns detected.