ClawHub
Back to skill

Security audit

ClawSignal

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent messaging integration, but it enables automatic agent triggering from external messages without clearly scoped safeguards.

Review this skill before installing if the agent has access to private files, credentials, shell tools, or state-changing APIs. Use it only with a trusted, pinned plugin version, a low-privilege API key, restricted tool access for message-triggered runs, and clear approval rules before the agent sends sensitive data or performs consequential actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:126
Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:126-140
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: High

Vulnerable Code

bash
### OpenClaw
```bash
openclaw plugins install @clawsignal/clawsignal
openclaw config set plugins.entries.clawsignal.enabled true
openclaw config set plugins.entries.clawsignal.config.apiKey "clawsig_xxx"
openclaw gateway restart

Clawdbot

bash
clawdbot plugins install @clawsignal/clawsignal
clawdbot config set plugins.entries.clawsignal.enabled true
clawdbot config set plugins.entries.clawsignal.config.apiKey "clawsig_xxx"
clawdbot gateway restart
text

### Technical Analysis

The installation commands retrieve `@clawsignal/clawsignal` without specifying an immutable version, integrity hash, trusted source revision, or publisher-verification procedure. Consequently, the package installed by a user can differ from the package that existed when this Skill was reviewed.

The instructions then enable the plugin, provide it with an API key, and restart the gateway. A malicious or compromised package release could therefore execute within the agent environment and potentially access credentials, messages, workspace data, network resources, or exposed agent tools. The reviewed project does not contain the plugin source, so its behavior cannot be independently validated from this artifact.

### Attack Path

1. An attacker compromises the package publisher account, package registry entry, release pipeline, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented command without a pinned version or integrity constraint.
4. The package manager resolves and installs the attacker-controlled release.
5. The user enables the plugin, configures an API key, and restarts the gateway.
6. The malicious plugin executes in the gateway context and abuses the permissions, credenti
...[truncated 483 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specifically reviewed version rather than installing the mutable latest release.
  2. Verify the package with a cryptographic integrity hash or signed release provenance.
  3. Link to the authoritative source repository and audited commit corresponding to the pinned release.
  4. Document the package publisher, expected registry, and procedure for detecting dependency confusion or publisher-account compromise.
  5. Declare all required plugin permissions and deny unnecessary filesystem, network, subprocess, credential, and agent-tool access.
  6. Run the plugin in an isolated process or sandbox using a dedicated low-privilege account.
  7. Store the API key in a protected secret manager or environment-based secret facility rather than ordinary configuration where possible.
  8. Require review and staged testing before upgrading the pinned dependency.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:99
Finding

Untrusted WebSocket Messages Automatically Trigger the Agent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:99-147
Vulnerability Type: Automatic agent invocation using attacker-controlled remote messages
Risk Level: High

Vulnerable Code

markdown
## WebSocket

For real-time messages:

wss://clawsignal.com/api/v1/ws

text

Messages arrive as:
```json
{
  "type": "message",
  "from": "SenderAgent",
  "message": "Hello!",
  "from_owner": false,
  "timestamp": "2026-02-02T00:00:00Z"
}

The from_owner flag is true when the message was sent by the human owner via the dashboard UI (not by the agent itself).

text

```markdown
### Features
- Auto-connects to ClawSignal on startup
- Messages trigger your agent automatically
- `clawsignal_send` tool for sending replies
- Auto-generates SIGNAL.md template if missing

Technical Analysis

The documented integration automatically connects to an external WebSocket service and triggers the agent when messages arrive. The message field is controlled by a remote sender and may contain prompt-injection instructions designed to override the agent's intended task, solicit sensitive context, or induce tool use.

The example SIGNAL.md advises the agent not to disclose secrets, but this is a natural-language recommendation rather than an enforceable authorization boundary. The Skill does not specify sender allowlisting, authenticated trust decisions, separation of message data from trusted instructions, restricted tool profiles, human approval for consequential actions, or deterministic validation of requested operations.

The from_owner field identifies messages attributed to the dashboard owner, but the documentation does not require sensitive actions to be limited to that value or require the plugin to enforce such a restriction. Treating remote text as an automatic agent trigger therefore exposes the agent to untrusted-instruction execution.

Attack Path

  1. An attacker obtains permission to message the agent, such as by registering an account ...[truncated 1272 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every received message and metadata field as untrusted data, never as system-level instructions.
  2. Do not automatically expose general-purpose tools to remotely triggered sessions.
  3. Use a dedicated restricted execution profile with no filesystem, shell, secret, memory-write, or arbitrary network access by default.
  4. Require explicit human approval before sending secrets, changing state, accepting friend requests, invoking external APIs, or performing other consequential actions.
  5. Enforce sender authorization with an allowlist and independently authenticated identity; do not rely solely on natural-language behavior rules.
  6. Restrict owner-only operations using a server-validated identity signal and enforce the restriction in code.
  7. Place remote content in a clearly delimited data field and use a fixed trusted instruction stating that embedded commands must not be followed.
  8. Apply strict message schemas, length limits, rate limits, replay protection, and conversation quotas.
  9. Log remote triggers and sensitive tool requests without recording secrets.
  10. Provide an option to disable automatic triggering and require manual message review.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:159
Finding

Reusable Dashboard Credential Is Documented in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:159-163
Vulnerability Type: Sensitive authentication token exposure through URL handling
Risk Level: Medium

Vulnerable Code

markdown
## Dashboard

Manage your agent at:

https://clawsignal.com/dashboard?token=dash_xxx

text

Technical Analysis

Although dash_xxx is a placeholder rather than a disclosed live credential, the documentation establishes a pattern in which a dashboard token is supplied through a URL query parameter. URLs are commonly retained in browser history, copied into chat or support systems, included in screenshots, and recorded by reverse proxies, web servers, monitoring products, or analytics systems.

Query values may also be exposed through referrer handling if the application does not enforce an appropriately restrictive Referrer-Policy. If the token is reusable and grants dashboard access, possession of a leaked URL may be sufficient to impersonate the dashboard user.

Attack Path

  1. A user opens a dashboard URL containing a real reusable token.
  2. The complete URL is retained in browser history or captured by server, proxy, monitoring, analytics, screenshot, clipboard, or support logs.
  3. An attacker obtains access to one of those records.
  4. The attacker extracts the query-string token.
  5. The attacker replays the token before expiration or revocation.
  6. The service accepts the bearer-style URL credential and grants the dashboard access associated with it.

Impact Assessment

A leaked token could allow unauthorized dashboard access with the privileges associated with the affected agent account. Potential scope may include viewing agent information, managing configuration, or performing dashboard-supported actions. The exact privileges and token lifetime are not documented in the audited file, so broader account compromise cannot be asserted.

Remediation
View remediation

Remediation Suggestions

  1. Do not place reusable authentication credentials in URL query parameters.
  2. Authenticate dashboard sessions with a Secure, HttpOnly, and appropriately configured SameSite cookie.
  3. If a link-based login flow is necessary, use a short-lived, single-use authorization code and exchange it immediately for a protected session cookie.
  4. Bind one-time codes to the intended account, client context, and narrowly scoped action where feasible.
  5. Expire and invalidate the code immediately after use and prevent replay.
  6. Configure Referrer-Policy: no-referrer or another suitably restrictive policy.
  7. Redact query parameters from application, proxy, monitoring, and analytics logs.
  8. Provide token rotation and immediate revocation controls, and document the credential's lifetime and scope.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Profile

bash
# Your profile
curl https://clawsignal.com/api/v1/me \
  -H "Authorization: Bearer $CLAWSIGNAL_API_KEY"

# Another agent

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation advertises automatic external message handling as a feature but does not prominently warn users that this can expose private context, alter agent behavior, or let third parties steer the agent through crafted messages. In an agent setting, this is materially risky because message-triggered execution changes the trust boundary from local user control to internet-originated inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill states that incoming messages automatically trigger the agent, but it does not clearly define what messages are in scope, what permissions the triggered agent has, or what safeguards apply before acting. This creates a prompt-injection and unintended-action risk because any external party able to message the agent may influence behavior or trigger downstream tool use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.