OpenClaw 插件安装常见问题排查

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:21 PM UTC
• Version: 1.0.0

Overview

This skill is a troubleshooting guide, but it recommends forced global npm installs without enough safety limits or rollback guidance.

Install only after verifying the exact package name, publisher, and source documentation. Avoid `--force` and elevated shells unless you have diagnosed the specific lock or permission problem, understand what global files may be overwritten, and have a rollback path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g tavily-mcp

Technical Analysis

The documented command installs the latest available release of tavily-mcp globally without pinning a reviewed version or verifying package provenance and integrity. npm packages can execute lifecycle scripts during installation. A global installation can also place executable files in a user-wide or system-wide binary directory.

No evidence establishes that the named package is malicious. The vulnerability is the unsafe dependency-installation pattern: the effective installed code can change after this skill has been reviewed.

Attack Path

1. An attacker compromises the npm publisher account, package, or release process.
2. The attacker publishes a malicious release under the referenced package name.
3. A user follows the documented unpinned installation command.
4. npm resolves the command to the attacker-controlled latest release.
5. Malicious lifecycle scripts execute with the privileges of the user running npm.
6. The package may install globally accessible executables or modify files writable by that user.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The accessible scope may include the user's files, environment variables, development credentials, npm configuration, and globally writable executable locations. If the command is run from an elevated shell, the impact could extend to system-wide files and other users.

Remediation

View remediation

Remediation Suggestions

• Pin the package to an explicitly reviewed version, such as tavily-mcp@X.Y.Z.
• Verify the npm publisher, repository, provenance attestations, signatures where available, and package integrity before installation.
• Review package contents and lifecycle scripts using commands such as npm view and npm pack before execution.
• Prefer a project-local or isolated installation over a global installation.
• Use a lockfile and reproducible installation workflow where applicable.
• Run installation without administrative privileges and from an environment that does not expose sensitive credentials.
• Document a trusted authoritative source for the expected package name and version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:89

Finding

Forced Global npm Installation Bypasses Installation Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 89; repeated as generic guidance at line 128
Vulnerability Type: Unsafe forced installation of global third-party dependencies
Risk Level: Medium

Complete Code Snippets:

bash

npm i -g clawhub --force

bash

npm install -g <package-name> --force

The second snippet is an English rendering of the generic package-name placeholder used at line 128; the command structure and security-sensitive -g and --force options are unchanged.

Technical Analysis

The documentation recommends combining a global npm installation with --force. This option suppresses npm safeguards and permits operations that npm would otherwise reject or warn about, including overwriting conflicting global files. Global packages may expose commands through shared executable paths and may run installation lifecycle scripts.

The recommendation is presented as a general response to Windows file and permission problems and is repeated as a generic troubleshooting option. It does not first require diagnosis of the file lock, verification of the target package, backup of affected files, or use of a non-privileged isolated installation.

No malicious behavior by clawhub is established. The risk arises because forced global installation weakens conflict protections and increases the consequences of a compromised or unexpected package release.

Attack Path

1. A package or publisher account is compromised, or a user selects an incorrect package after searching for a similarly named plugin.
2. The user follows the documented global installation command with --force.
3. npm downloads the unpinned package and executes any applicable lifecycle scripts.
4. Forced installation allows conflicting global files or command shims to be replaced despite normal safeguards.
5. An attacker-controlled executable becomes available through the user's command search path.

...[truncated 560 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --force from the default and generic troubleshooting instructions.
• Diagnose file locks and permission failures before reinstalling; close processes using the files and inspect ownership and access controls.
• Pin the package to a reviewed version and verify its publisher, provenance, repository, integrity, and lifecycle scripts.
• Prefer local or isolated installation rather than modifying the global package and executable directories.
• Avoid running npm from an elevated shell. Do not recommend elevation as a routine workaround.
• If forced installation is unavoidable, document the exact diagnosed condition, affected paths, backup procedure, expected changes, and rollback steps.
• Verify global executable paths and package contents after installation to detect unexpected replacement.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill recommends npm install -g ... --force as a general troubleshooting step for Windows installation issues without sufficient warning about the risks. Forced global installs can overwrite files, bypass safer failure modes, and leave the user's global package environment in an inconsistent or harder-to-audit state, especially when the package name or source has not been fully validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.