Owletto OpenClaw Setup

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:09 AM UTC
• Version: 1.7.0

Overview

This skill is a straightforward setup guide for an Owletto memory plugin, with a normal third-party install risk users should verify before running.

Before installing, confirm the Owletto package source and version are the ones you intend to trust, and use a local or trusted MCP endpoint if you do not want memory data sent to a cloud service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unverified and Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-28
Vulnerability Type: Unpinned third-party dependency from an unspecified registry
Risk Level: Medium

Vulnerable Code:

markdown

1. Install the OpenClaw plugin.

```bash
openclaw plugins install owletto-openclaw-plugin

text

### Technical Analysis

The documented installation command identifies the plugin only by package name. It does not specify an exact version, trusted registry, cryptographic checksum, package signature, or immutable source revision. Consequently, the code installed when this command is executed may differ from the code that was originally reviewed.

This creates a supply-chain risk if the package registry, publisher account, package name resolution, or a later plugin release is compromised. Installation and loading of such a package may execute third-party code under the identity and permissions of the OpenClaw process.

### Attack Path

1. An attacker compromises the package publisher, registry, or package distribution channel, or causes the package name to resolve to an unauthorized artifact.
2. The attacker publishes a malicious version under the referenced package name.
3. A user follows the skill instructions and runs `openclaw plugins install owletto-openclaw-plugin`.
4. OpenClaw retrieves the current package without validating an expected version, checksum, or signature.
5. The malicious plugin is installed and loaded.
6. The plugin executes with the permissions available to OpenClaw and accesses any data or resources exposed to that process.

### Impact Assessment

Successful exploitation could provide code execution with the operating-system privileges of the user running OpenClaw. Depending on OpenClaw's environment and plugin interface, the malicious package could access conversations, long-term memory, plugin configuration, OAuth state or tokens available to the process, MCP data, and user-accessible fi
...[truncated 149 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a specifically reviewed, immutable version rather than installing the latest package by name.
• Specify the official registry, publisher identity, and canonical package source.
• Verify the downloaded artifact using a documented cryptographic checksum or trusted package signature before installation.
• Maintain a lockfile or equivalent integrity metadata where supported.
• Review the plugin's source code and requested permissions before enabling it.
• Run OpenClaw and third-party plugins with least privilege, restricting filesystem, credential, and network access to only what is required.
• Establish a controlled update process in which new plugin versions are reviewed and integrity metadata is updated before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.