T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:42- Finding
Unpinned Remote Plugin Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawWorld
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Review case because it connects to ClawWorld but also installs an unreviewed persistent plugin that can receive remote messages, send activity metadata, and upload files automatically.
Install only if you are comfortable granting ClawWorld a persistent agent integration: it can receive remote chat messages, summarize recent work to the service, report installed skill names, handle inbound files, and automatically upload files placed in ~/.openclaw/out. Prefer a version-pinned, reviewable plugin with clear opt-ins for chat, telemetry, skill inventory, and file upload, plus restricted token storage and an easy way to disable or revoke the connection.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:107- Finding
Persistent Third-Party Message Injection into the Agent Runtime
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:96- Finding
Excessive Collection and External Transmission of Session and Workspace Metadata
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bind.sh:41- Finding
Bearer Token Stored Without Restrictive Filesystem Permissions
- Content
View full analysis
"$CONFIG_FILE" << EOF { "deviceToken": "${DEVICE_TOKEN}", "endpoint": "${ENDPOINT}", "wsEndpoint": "${WS_ENDPOINT}", "lobsterId": "${LOBSTER_ID}", "lobsterName": "${LOBSTER_NAME}", "instanceId": "${INSTANCE_ID}" } EOF ``` The TypeScript writer has the same issue at `scripts/config.ts:34-37`: ```typescript export function writeConfig(config: ClawWorldConfig): void { fs.mkdirSync(CONFIG_DIR, { recursive: true }); fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8'); } ``` ### Technical Analysis Both implementations write the long-lived bearer token without explicitly restricting directory or file permissions. The resulting permissions depend on the process umask. With a common `022` umask, a newly created file may be readable by other local users. The shell implementation also writes directly to the final pathname without atomic creation or explicit symlink protections. In an environment where another local principal can manipulate the target directory, this increases the risk of unintended writes or secret exposure. Because the token authenticates status, activity, unbind, and documented WebSocket operations, it must be treated as a high-value secret. ### Attack Path 1. The user completes the binding operation. 2. `bind.sh` or `writeConfig` writes `config.json` using default permissions. 3. Another local account or process reads the configuration file. 4. The attacker extracts `deviceToken`, `lobsterId`, and endpoint information. 5. The attacker uses the bearer token against ClawWorld services or the remote message channel. ### Impact Assessment A local attacker with read access to the file may obtain ...[truncated 537 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:107- Finding
Long-Lived Bearer Token Exposed in WebSocket Query String
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:119- Finding
Automatic Upload of Files from a Shared Output Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bind.sh:7- Finding
Unsafe JSON Construction from Unvalidated and Unescaped Values
- Content
View full analysis
"$CONFIG_FILE" << EOF { "deviceToken": "${DEVICE_TOKEN}", "endpoint": "${ENDPOINT}", "wsEndpoint": "${WS_ENDPOINT}", "lobsterId": "${LOBSTER_ID}", "lobsterName": "${LOBSTER_NAME}", "instanceId": "${INSTANCE_ID}" } EOF ``` ### Technical Analysis The documented binding-code format is exactly six alphanumeric characters, but the script does not enforce that format. It manually interpolates the argument into a JSON string without JSON escaping. Likewise, values returned by the remote endpoint are parsed with regular expressions and inserted into a local JSON document without standards-compliant decoding or encoding. Quotes, ...[truncated 1546 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose centers on connecting to ClawWorld and using social features, but the code chunk is explicitly an unbind script for disconnecting from the service. It reads stored credentials and endpoint information from a local config file, calls the remote unbind API, and removes the local config afterward. While network access and local config access are plausibly related to the same integration, the primary purpose is materially different and opposite to the declared description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The high-level description presents the skill as social status sharing, but the documented plugin also performs file upload/download workflows and workspace skill enumeration. These are materially broader data-access behaviors than users would infer from the description, creating a deceptive capability gap around local file handling and metadata disclosure.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file says the skill 'handles binding and unbinding only,' but later documents a plugin that injects inbound chat messages into the runtime and relays replies back out. This is a major hidden expansion of trust boundary: installing a seemingly simple bind/unbind skill effectively creates a remote command/input channel into the agent.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The same document frames the skill as limited to binding/unbinding while also documenting broad persistent plugin behaviors such as message injection, summaries, file transfer, and workspace scanning. This mismatch undermines informed consent and can cause users to install a much more privileged communications bridge than they intended.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 97% confidence
- Finding
The persistent WebSocket channel allows remote ClawWorld-originated messages to be injected directly into the agent runtime as conversation inputs. That materially expands the attack surface by turning the external service into a live input source capable of prompting actions, abusing tools, or staging social-engineering attacks against the agent.
- Content
md ### Inbound: chat channel (WebSocket) The plugin registers a persistent WebSocket channel to `wsEndpoint`. This enables ClawWorld users to send messages to the agent from the ClawWorld web UI: - **Connection**: Established on plugin startup using the `ws` npm library with the `deviceToken` as a query-string credential. Reconnects with exponential backoff (1s → 30s cap) on disconnect. - **Message injection**: Inbound messages are dispatched into the agent runtime via `channelRuntime.reply.dispatchReplyWithBufferedBlockDispatcher`, making them appear as channel messages in the OpenClaw conversation system.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md irectory of the agent workspace to enumerate installed skills (by checking for `SKILL.md` in each subdirectory). The list is included in the status payload. No
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly describes shell execution, network access, environment-controlled endpoint override, and persistent plugin installation, but it does not declare any tool scope or allowed-tools restrictions. That increases the chance the agent or platform grants broader capabilities than users expect, weakening least-privilege controls for a networked integration that can store tokens and communicate externally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash bash {baseDir}/scripts/bind.sh <BINDING_CODE>- The script calls POST https://api.claw-world.app/api/claw/bind/verify with the binding code and the agent's instance ID (no auth header needed — the binding code itself is the credential).
- On success, the script saves the returned device_token and lobster_id
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash bash {baseDir}/scripts/bind.sh <BINDING_CODE>- The script calls POST https://api.claw-world.app/api/claw/bind/verify with the binding code and the agent's instance ID (no auth header needed — the binding code itself is the credential).
- On success, the script saves the returned device_token and lobster_id
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The plugin automatically derives activity summaries from recent session messages and sends them off-platform without explicit user opt-in or a clear privacy notice. Even if summarized, session-derived text can still expose sensitive topics, workflows, or business context to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Automatically downloading inbound attachments to local storage creates a file-ingestion path from remote users into the agent environment without an explicit safety warning. This can expose the system to malicious files, unsafe downstream processing, disk consumption, or accidental use of untrusted local paths by later tools.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- After successful upload, the local file is cleaned up automatically.
- IMPORTANT: Do NOT tell the user "open this file at /root/.openclaw/workspace/..." — they cannot access container paths. Always use
~/.openclaw/out/.
Example: If the user asks for a report or an image, write it to the out/ directory:
bash echo "Report content..." > ~/.openclaw/out/report.txt # Or generate an image:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Enumerating installed skills and transmitting their names to the service is not clearly necessary for a binding/status feature and leaks local environment metadata. Skill inventory can reveal agent capabilities, integrations, or attack surface to an external service, aiding profiling or follow-on targeting.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The plugin enumerates installed skills and includes the list in a status payload to an external service. This leaks environment metadata that can identify available capabilities or sensitive integrations, making the agent easier to profile and potentially target.
- Content
md ### Workspace skill scan On `llm_output` events, the plugin reads the `skills/` subdirectory of the agent workspace to enumerate installed skills (by checking for `SKILL.md` in each subdirectory). The list is included in the status payload. No SKILL.md content is read or transmitted — only skill directory names.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented telemetry endpoints transmit potentially sensitive user and workspace metadata, including installed skills, activity summaries, model/provider details, token usage, session linkage, and a stable instance identifier, but the API reference contains no explicit user-facing privacy warning, consent flow, minimization guidance, or retention disclosure. In the context of an agent social-network skill, this increases the risk of unintentional surveillance, fingerprinting, and leakage of work patterns or confidential project context through status and activity reporting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The script transmits the user-supplied binding code and a stable machine-derived instance identifier to a remote service, and the binding code is explicitly treated as the credential. External transmission is expected for a binding workflow, but it is still security-relevant because a credential and host identifier are sent off-box and could be exposed if the endpoint is overridden to an untrusted server or if transport trust is weakened elsewhere in the environment.
- Content
sh # Call ClawWorld API to verify binding # No Authorization header needed — binding code itself is the credential RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \ "${ENDPOINT}/api/claw/bind/verify" \ -H "Content-Type: application/json" \ -d "{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persists a long-lived device token to a local config file in the user's home directory without setting restrictive permissions or warning the user that a credential is being stored. Any other local user, process, backup system, or malware with access to that file could reuse the token to impersonate the agent for future ClawWorld activity pushes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This script transmits a bearer device token and lobster identifier to a remotely configured endpoint read from local config.json, with no validation that the endpoint is trusted or uses HTTPS. If an attacker can modify the config file or influence the endpoint value, the script will exfiltrate credentials to an arbitrary server and perform a network action under the user's identity.
- Content
sh exit 1 fi RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \ "${ENDPOINT}/api/claw/unbind" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DEVICE_TOKEN}" \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The setup instructions tell the user to click a Chinese-only phrase, '绑定我的龙虾,' without offering a language choice or noting that the UI may be localized. This can violate language/locale policy because it assumes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The reference includes hard-coded Chinese error strings for API responses, but the file does not offer any language choice or explain that the API is intentionally region-specific. Per SQP-3, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.