Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent ClinkBill payment-integration helper, but it needs Review because it handles payment secrets and includes under-scoped remote context, documentation loading, API destination, and shell restart mechanisms.
Install only in a trusted workspace and keep it sandbox-first. Prefer environment-variable references, a platform secret store, or an OS/managed secret store over plaintext profile or .env.local secrets; verify .env files are ignored and permission-restricted. Do not set CLINK_DOCS_URL or payment-skill URL/path overrides to untrusted sources, avoid --restart-command in agent-run flows, and use only approved Clink API hosts for authenticated commands, especially with production keys.
vendor/clink-integ-cli/clink-integ-cli.js:3565Secret Key Disclosure Through Unrestricted API Base URLs
scripts/load_payment_skill_contexts.mjs:13Unverified Mutable Remote Skill Context Can Hijack Agent Instructions
lib/docs-runtime.mjs:76Official Documentation Loader Allows SSRF, Local File Reads, and Context Poisoning
vendor/clink-integ-cli/clink-integ-cli.js:3754Payment Credentials Are Stored in Plaintext Without Enforced File Permissions
vendor/clink-integ-cli/clink-integ-cli.js:5905Webhook Environment Synchronization Supports Unrestricted Shell Command Execution
The webhook setup command uses --save-secret and --sync-env-file .env.local, which directs an agent to persist a sensitive signing secret into a local environment file. In agent-driven workflows, this is dangerous because such files may be accidentally committed, exposed to other tools, or included in logs and artifacts, leading to forged webhook events if the secret is disclosed.
--url https://example.com/api/clink/webhook
--events core
--save-secret
--sync-env-file .env.local
--json
The command explicitly saves and synchronizes a webhook secret into .env.local, creating a concrete credential persistence path inside the project workspace. In agent-driven or shared development environments, secrets stored in local files are at elevated risk of accidental commit, workspace leakage, backup collection, or access by unrelated tools, making this more dangerous than a purely conceptual mention of secret handling.
--url https://example.com/api/clink/webhook
--events core
--save-secret
--sync-env-file .env.local
--json
The declared description is narrowly about Clink/ClinkBill payment integration workflows. The actual code shown is infrastructure code from Commander.js, a general-purpose command-line interface library. It provides parsing, help formatting, error handling, option/env processing, and subcommand execution, but no visible logic for Secret Key bootstrap, webhook setup, catalog import, checkout/subscription APIs, signature verification, sandbox validation, onboarding, or merchant integration review. While such a library could support a Clink integration CLI, this chunk itself does not implement the declared domain-specific capabilities, so the description does not accurately represent what this supplied code chunk actually does.
Referenced artifact was not completely inspected
- run `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path`, then read the generated OpenClaw payment skill context
Referenced artifact was not completely inspected
- run `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path`, then read the generated OpenClaw payment skill context
Referenced artifact was not completely inspected
- run `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path`, then read the generated OpenClaw payment skill context
Referenced artifact was not completely inspected
- run `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path`, then read the generated OpenClaw payment skill context
Referenced artifact was not completely inspected
- run `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path`, then read the generated OpenClaw payment skill context
Referenced artifact was not completely inspected
- for clink-integ-cli work, use the offline bundled CLI at `vendor/clink-integ-cli/clink-integ-cli.js`; do not install `clink-integ-cli` from GitHub or npm duri
Referenced artifact was not completely inspected
- for clink-integ-cli work, use the offline bundled CLI at `vendor/clink-integ-cli/clink-integ-cli.js`; do not install `clink-integ-cli` from GitHub or npm duri
Referenced artifact was not completely inspected
- for validation tasks, prefer `node scripts/lint_contract.mjs`, `node scripts/lint_webhook_design.mjs`, and `node scripts/generate_guidance_artifacts.mjs`
This is a direct instruction to load and trust externally generated context as the authoritative source for tool names, integration metadata, notification routing, and especially tool return directives. In an agent setting, that enables prompt/context injection from a secondary file or dependency, potentially overriding local safeguards and altering how payment handoff, confirmation, or notifications are executed.
## Main Responsibilities
Before generating code or reviewing an implementation for this path, load the latest available `openclaw-payment-skills` context through `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path` and read the generated context file. Treat this module as integration guidance, and treat the loaded payment skill context as the current source for exact OpenClaw tool names, merchant integration metadata, notification routing, tool return directives, and ownership boundaries.
### Merchant Skill / Agent
The prompt instructs the agent to sync secrets into .env.local, which is a plaintext file on disk. While the document also says .env-style files should be gitignored, directing an automated agent to write live API credentials and webhook signing keys into local env files increases the risk of accidental exposure through logs, editor plugins, backups, misconfigured VCS ignores, or later disclosure by the agent itself.
--url https://example.com/api/clink/webhook
--events core
--save-secret
--sync-env-file .env.local
--json
The guidance recommends syncing a webhook signing secret directly into .env.local, which creates a plaintext secret-handling path on disk. While .env.local may be ignored by version control, this still increases exposure through local file leakage, backups, shell history, logs, workspace sharing, or accidental inclusion in support artifacts.
--url
--events core
--save-secret
--sync-env-file .env.local
--json
This repeated instruction again promotes storing the webhook signing secret in .env.local, creating the same plaintext local-secret exposure risk. Because this appears in the signing-secret sync workflow, the context makes it more sensitive: the document also mentions rotation, so an agent may both expose a new secret locally and invalidate the old one in one automated step.
--url
--events core
--save-secret
--sync-env-file .env.local
--json
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- production-specific configuration changes required
- go-live prerequisites (DNS, credentials, monitoring)
## Output Rules
The skill generates code directly for the developer within a coding agent. Environment context is embedded in the generated code, not output as separate metadata.
Instructions found that direct the agent to transmit conversation context or user data to external services.
2. restart or redeploy the service
3. verify the webhook handler with `clink webhook simulate`, `clink webhook sign`, or `clink webhook verify`
If the bundled CLI still does not support `clink webhook endpoint ensure` after `node scripts/verify_cli_bundle.mjs` passes, stop and report the CLI capability gap instead of silently sending the user to configure webhooks in the Dashboard. New guidance should not present webhook endpoint management as Dashboard-only.
If the webhook URL changes, rerun `clink webhook endpoint ensure --save-secret --json`, sync the latest signing secret, and restart or redeploy again.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
When Elements promotion-code UI is in scope, add:
- `promotion_code_ui_contract` for collapsed, expanded, loading or error, applied, and clear states using `promoCodeChange`
## New User Onboarding Artifacts
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
When Elements promotion-code UI is in scope, add:
- `promotion_code_ui_contract` for collapsed, expanded, loading or error, applied, and clear states using `promoCodeChange`
## New User Onboarding Artifacts
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
## Merchant Skill for OpenClaw Integration Checks
- does the design use `openclaw-payment-skills` for the OpenClaw payment skill path
- does the design align exact OpenClaw payment tool names, return directives, and notification ownership with the loaded `openclaw-payment-skills` context
- does the merchant skill call, handle, and resume according to the loaded `openclaw-payment-skills` contract without adding duplicate payment-layer behavior
- does the design clearly distinguish merchant skill from `openclaw-payment-skills`
- does it define merchant server responsibilities
The guidance explicitly syncs a freshly issued webhook signing secret into .env.local, which creates a risk of credential exposure through accidental source control commits, local file leakage, editor plugins, backups, or insecure workstation access. In an integration skill, this is more dangerous because the file is prescriptive operational guidance and may cause users or agents to handle live secrets in less controlled storage than a proper secret manager.
--url
--events core
--save-secret
--sync-env-file .env.local
--json
The runtime exposes a --skip-validation flag that disables validation checks before executing integration actions. In a payment-integration skill, this can let an operator or downstream automation bypass safety checks and proceed with misconfigured or risky production workflows, especially if environment/route detection is imperfect or if non-gated routes still have meaningful side effects.
validationFile: null,
docsSource: process.env.CLINK_DOCS_URL || undefined,
docsFallbackSource: process.env.CLINK_DOCS_FALLBACK_PATH || null,
skipValidation: values.includes("--skip-validation"),
confirmUnvalidatedProduction: values.includes("--confirm-unvalidated-production"),
allowFixtureFallback: values.includes("--allow-fixture-fallback"),
json: values.includes("--json"),
The code only blocks --skip-validation for production when a route is in GATED_PRODUCTION_ROUTES, meaning validation bypass remains possible for other routes. If route classification is incomplete or a supposedly non-gated route still performs sensitive payment setup actions, this creates a path to operate without required safeguards.
requiresExplicitUnvalidatedConfirmation &&
!options.confirmUnvalidatedProduction
) {
throw new Error("--skip-validation requires --confirm-unvalidated-production");
}
const validationInput = options.validationFile ? fs.readFileSync(options.validationFile, "utf8") : null;
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
runtimeScript,
"--prompt",
"Deploy to production our Clink checkout webhook integration.",
"--skip-validation",
"--allow-fixture-fallback",
"--json",
];
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
runtimeScript,
"--prompt",
"Deploy to production our Clink checkout webhook integration.",
"--skip-validation",
"--allow-fixture-fallback",
"--json",
];
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal