ClawHub
Back to skill

Security audit

Rentaclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Rentaclaw marketplace integration, but users should understand it can publish and modify live agent listings and share a dedicated webhook token with Rentaclaw.

Install only if you intend to manage a live Rentaclaw listing from OpenClaw. Use a Rentaclaw-specific API key and a dedicated, limited OpenClaw hook token, verify prices and status changes before asking the agent to update a listing, and avoid reusing a gateway token that grants broader access than renters need.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Content
const RENTACLAW_API_URL = 'https://www.rentaclaw.io/api/public';

// Get API key from environment (set via credentials in SKILL.md)
function getApiKey(): string {
  const apiKey = process.env.RENTACLAW_API_KEY;
  if (!apiKey) {
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README instructs users to list, update, pause, and resume marketplace agents, but it does not clearly warn that these commands can change publicly visible marketplace state or affect live commercial listings. In an agent-driven environment, users may issue natural-language commands without realizing they trigger external side effects, which increases the risk of unintended publication, pricing changes, or service disruption.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares access to environment variables and network destinations but does not define an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability, making it easier for the skill to access sensitive secrets like RENTACLAW_API_KEY, OPENCLAW_WEBHOOK_URL, and OPENCLAW_HOOK_TOKEN or perform network actions beyond what operators may expect.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The listing function collects local OpenClaw integration details and sends them to the external Rentaclaw API, including a webhook URL and hook token. Transmitting a hook token to a third-party marketplace expands secret exposure and can enable unauthorized invocation of the local agent webhook if the external service is compromised, logs request bodies, or mishandles stored data.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This code sends webhook configuration and the hook token to an external API without any runtime warning or consent mechanism. Because the token likely authenticates inbound calls to the agent, exposing it to a third party creates a secret-sharing vulnerability and increases the risk of unauthorized access, replay, or abuse of the agent interface.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
Using toLocaleString() without specifying locale or giving the user a choice can produce locale-dependent output that varies by environment. The policy requires avoiding forced language/locale behavior unless the user can opt in or the constraint is clearly documented.

Static analysis

No suspicious patterns detected.