Openclaw Skills Setup Cn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:53 AM UTC
• Version: 1.0.0

Overview

This is a coherent ClawHub setup skill, but it recommends broad unpinned global installs and bulk skill updates that can change an agent environment without enough scoping or review guidance.

Review the specific ClawHub CLI version and each recommended skill before installing. Prefer pinned versions, run inspect before install or update, avoid update --all in sensitive environments, and do not run global package installs with elevated privileges unless you have independently verified the package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global Installation of the ClawHub CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g clawhub
pnpm add -g clawhub

Technical Analysis

The documented installation commands retrieve the latest available clawhub package without specifying an exact version or validating package integrity. Global npm and pnpm installations can also execute package lifecycle scripts, such as preinstall, install, and postinstall, under the privileges of the user running the package manager.

Because the effective package contents can change after this Skill has been reviewed, compromise of the package, publisher account, registry, or dependency chain could cause users to install code that was not included in the audit. The use of global installation increases the potential reach by placing the package in the user's global tool environment.

No evidence establishes that the current clawhub package is malicious. The vulnerability is the unsafe, unpinned supply-chain installation procedure.

Attack Path

1. An attacker compromises the package publisher, registry entry, or a transitive dependency used by a future clawhub release.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented unpinned global installation command.
4. npm or pnpm downloads the attacker-controlled release.
5. Malicious lifecycle scripts or subsequently invoked CLI code execute with the privileges of the installing user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. Depending on those privileges and the local environment, affected resources may include user files, environment variables, credentials accessible to the user, global package configuration, and the Agent's local tools. Admin ...[truncated 171 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, for example clawhub@X.Y.Z, rather than implicitly installing the latest release.
• Document the expected registry and reject unexpected registry overrides.
• Publish and verify package integrity information or signed release provenance where supported.
• Review the package, its lifecycle scripts, and its dependency lock data before recommending a new version.
• Avoid running global package installation with administrative privileges.
• Prefer a controlled environment, isolated prefix, or disposable container when evaluating new releases.
• Establish an explicit upgrade process that reviews release diffs before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Installation and Bulk Update of Third-Party Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43, 71-74, and 81-84; README.md, line 24
Vulnerability Type: Unverified and unpinned third-party Skill acquisition
Risk Level: Medium

Vulnerable Code

SKILL.md, line 43:

bash

clawhub install tavily-search find-skills proactive-agent-1-2-4 pdf-chat file-organizer

SKILL.md, lines 71-74:

bash

clawhub install SKILL_NAME
clawhub install SKILL_NAME@VERSION

SKILL.md, lines 81-84:

bash

clawhub update SKILL_NAME
clawhub update --all

README.md, line 24:

bash

clawhub install openclaw-skills-setup-cn

Technical Analysis

The Skill recommends batch installation of several external skills without pinning reviewed versions in the primary setup command. It also recommends unpinned individual installation and bulk updates. Although the documentation mentions inspecting interesting search results elsewhere, inspection is not required before the batch installation or update operations.

Skill packages may contain instructions or executable components that operate within an Agent environment. Their contents can change between releases. Consequently, clawhub update --all can replace previously reviewed versions with newly published content without a per-package security review.

A compromised publisher, registry, skill package, or future release could therefore introduce hostile instructions or executable payloads through an otherwise legitimate-looking installation or update operation. No evidence establishes that any named skill is currently malicious; the finding concerns the unsafe dependency-management process.

Attack Path

1. An attacker compromises a listed skill publisher, the distribution registry, or a future skill release.
2. The attacker publishes a malicious version containing hostile Agent instructions or executable components.
3. A user follows the batch installation guidance or r ...[truncated 807 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every recommended skill to a specific version that has been reviewed.
• Require clawhub inspect before each installation and document the security checks users should perform.
• Replace automatic update --all guidance with a controlled update workflow that reviews each version and its changes separately.
• Verify package origin, publisher identity, signatures, checksums, and registry provenance where supported.
• Maintain an allowlist of approved skills and versions.
• Test new or updated skills in an isolated Agent environment with minimal tool permissions before production use.
• Record reviewed hashes or signed manifests so that installation can detect changed package contents.
• Apply least privilege to installed skills and prevent newly installed packages from automatically receiving sensitive tools or credentials.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The title and description explicitly position the skill as intended for Chinese users (“setup-cn”, “面向中文用户”) but do not indicate any user opt-in for language preference or explain a necessary regional/compliance reason for the restriction. This can be a natural-language locale policy issue because it implies a fixed language audience without offering alternatives.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases for skill discovery and management are broad, generic user intents such as '找技能', '搜索 skill', and '安装 skill'. In an agentic environment, this can cause the skill to activate for many unrelated requests and steer users toward package installation or recommendations without sufficiently narrow scoping, increasing the risk of unintended invocation and supply-chain exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The text explicitly says it helps Chinese users and presents the skill primarily in Chinese, but it does not indicate that users may choose another language or locale. Under the language/locale policy, forcing or defaulting to a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are very broad and cover common requests like finding, recommending, installing, and managing skills. This can cause the skill to activate in many routine conversations and steer users toward package discovery and installation flows without clear user intent, increasing the chance of unintended command suggestions or supply-chain exposure.

Content

No source excerpt is available for this finding.