Security audit

Openclaw Skills Setup Cn

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ClawHub setup skill, but it recommends broad unpinned global installs and bulk skill updates that can change an agent environment without enough scoping or review guidance.

Review the specific ClawHub CLI version and each recommended skill before installing. Prefer pinned versions, run inspect before install or update, avoid update --all in sensitive environments, and do not run global package installs with elevated privileges unless you have independently verified the package source.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Global Installation of the ClawHub CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 20-23 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g clawhub pnpm add -g clawhub ``` ### Technical Analysis The documented installation commands retrieve the latest available `clawhub` package without specifying an exact version or validating package integrity. Global npm and pnpm installations can also execute package lifecycle scripts, such as `preinstall`, `install`, and `postinstall`, under the privileges of the user running the package manager. Because the effective package contents can change after this Skill has been reviewed, compromise of the package, publisher account, registry, or dependency chain could cause users to install code that was not included in the audit. The use of global installation increases the potential reach by placing the package in the user's global tool environment. No evidence establishes that the current `clawhub` package is malicious. The vulnerability is the unsafe, unpinned supply-chain installation procedure. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or a transitive dependency used by a future `clawhub` release. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented unpinned global installation command. 4. npm or pnpm downloads the attacker-controlled release. 5. Malicious lifecycle scripts or subsequently invoked CLI code execute with the privileges of the installing user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. Depending on those privileges and the local environment, affected resources may include user files, environment variables, credentials accessible to the user, global package configuration, and the Agent's local tools. Admin ...[truncated 171 chars]
Remediation: ## Remediation Suggestions - Pin the CLI to a reviewed exact version, for example `clawhub@X.Y.Z`, rather than implicitly installing the latest release. - Document the expected registry and reject unexpected registry overrides. - Publish and verify package integrity information or signed release provenance where supported. - Review the package, its lifecycle scripts, and its dependency lock data before recommending a new version. - Avoid running global package installation with administrative privileges. - Prefer a controlled environment, isolated prefix, or disposable container when evaluating new releases. - Establish an explicit upgrade process that reviews release diffs before changing the pinned version.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Installation and Bulk Update of Third-Party Skills## Vulnerability Details **File Location**: `SKILL.md`, lines 43, 71-74, and 81-84; `README.md`, line 24 **Vulnerability Type**: Unverified and unpinned third-party Skill acquisition **Risk Level**: Medium ### Vulnerable Code `SKILL.md`, line 43: ```bash clawhub install tavily-search find-skills proactive-agent-1-2-4 pdf-chat file-organizer ``` `SKILL.md`, lines 71-74: ```bash clawhub install SKILL_NAME clawhub install SKILL_NAME@VERSION ``` `SKILL.md`, lines 81-84: ```bash clawhub update SKILL_NAME clawhub update --all ``` `README.md`, line 24: ```bash clawhub install openclaw-skills-setup-cn ``` ### Technical Analysis The Skill recommends batch installation of several external skills without pinning reviewed versions in the primary setup command. It also recommends unpinned individual installation and bulk updates. Although the documentation mentions inspecting interesting search results elsewhere, inspection is not required before the batch installation or update operations. Skill packages may contain instructions or executable components that operate within an Agent environment. Their contents can change between releases. Consequently, `clawhub update --all` can replace previously reviewed versions with newly published content without a per-package security review. A compromised publisher, registry, skill package, or future release could therefore introduce hostile instructions or executable payloads through an otherwise legitimate-looking installation or update operation. No evidence establishes that any named skill is currently malicious; the finding concerns the unsafe dependency-management process. ### Attack Path 1. An attacker compromises a listed skill publisher, the distribution registry, or a future skill release. 2. The attacker publishes a malicious version containing hostile Agent instructions or executable components. 3. A user follows the batch installation guidance or r ...[truncated 807 chars]
Remediation: ## Remediation Suggestions - Pin every recommended skill to a specific version that has been reviewed. - Require `clawhub inspect` before each installation and document the security checks users should perform. - Replace automatic `update --all` guidance with a controlled update workflow that reviews each version and its changes separately. - Verify package origin, publisher identity, signatures, checksums, and registry provenance where supported. - Maintain an allowlist of approved skills and versions. - Test new or updated skills in an isolated Agent environment with minimal tool permissions before production use. - Record reviewed hashes or signed manifests so that installation can detect changed package contents. - Apply least privilege to installed skills and prevent newly installed packages from automatically receiving sensitive tools or credentials.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The title and description explicitly position the skill as intended for Chinese users (“setup-cn”, “面向中文用户”) but do not indicate any user opt-in for language preference or explain a necessary regional/compliance reason for the restriction. This can be a natural-language locale policy issue because it implies a fixed language audience without offering alternatives.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases for skill discovery and management are broad, generic user intents such as '找技能', '搜索 skill', and '安装 skill'. In an agentic environment, this can cause the skill to activate for many unrelated requests and steer users toward package installation or recommendations without sufficiently narrow scoping, increasing the risk of unintended invocation and supply-chain exposure.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The text explicitly says it helps Chinese users and presents the skill primarily in Chinese, but it does not indicate that users may choose another language or locale. Under the language/locale policy, forcing or defaulting to a specific language without opt-in can be a natural-language policy issue.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are very broad and cover common requests like finding, recommending, installing, and managing skills. This can cause the skill to activate in many routine conversations and steer users toward package discovery and installation flows without clear user intent, increasing the chance of unintended command suggestions or supply-chain exposure.

Static analysis

No suspicious patterns detected.