ClawHub
Back to skill

Security audit

Openclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed BKMRK API integration that can read and modify a user's bookmark library and send submitted content to Claude for analysis.

Install this only if you are comfortable giving an agent your BKMRK API key and letting BKMRK send submitted or synced bookmark content to Claude for analysis. Review before bulk trashing or changing bookmark/project status, and do not submit private pages, confidential transcripts, secrets, or sensitive project metadata unless that sharing is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ssd 3

High
Confidence
93% confidence
Finding
The `analysis_persona` field is described as text injected into Claude's system prompt, which means untrusted project metadata can directly influence downstream model behavior. This is a prompt-injection pathway that could alter analysis, suppress safeguards, exfiltrate sensitive context from other inputs, or bias scoring and recommendations in unsafe ways.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly states that full extracted content from URLs, transcripts, threads, and articles is sent to Claude for analysis, but it does not require a clear user-facing warning or confirmation at the point of submission. This creates a privacy and data-sharing risk because users may submit sensitive URLs or content without realizing that fetched material and derived text will be transmitted to a third-party AI service.

Ssd 3

Medium
Confidence
87% confidence
Finding
The skill describes broad, uncapped extraction and routing of bookmark content, transcripts, thread text, and linked URLs to an LLM without defining minimization boundaries or sensitivity checks. This increases the chance that secrets, personal data, proprietary content, or unexpectedly large context are transmitted downstream unnecessarily.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The onboarding flow sends an email address and consent to create an account and return an API key, but the skill text does not require a clear warning that personal data is being transmitted and used for account provisioning. Users may not understand that this action shares identifying information with an external service and results in credential issuance tied to that identity.

Static analysis

No suspicious patterns detected.