ClawHub
Back to skill

Security audit

OpenClaw Task Experience Summaries

Security checks for vulnerabilities and agentic risk

Overview

This is a troubleshooting reference skill that gives disclosed installation and configuration advice, with some supply-chain hygiene cautions users should apply before running the suggested commands.

Before following the examples, verify exact package or skill names, publisher identity, source repository, requested permissions, and version. Avoid running npm global installs as administrator/root, treat force installs as a last resort after checking the conflicting file, and test unfamiliar skills in a low-risk environment before using them with sensitive files or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding
Unpinned Global Package Installation with Unsafe Force Override## Vulnerability Details **File Location**: `SKILL.md:29` and `SKILL.md:96` **Vulnerability Type**: Unpinned global dependency installation and forced file replacement **Risk Level**: Medium ### Complete Code Snippets At `SKILL.md:27-30`: ```bash **Installation:** ```bash npm install -g clawhub ``` ``` At `SKILL.md:94-97`: ```bash **Solution:** ```bash npm i -g clawhub --force ``` ``` ### Technical Analysis The instructions install the mutable latest version of the `clawhub` npm package globally without a version pin, integrity validation, or provenance verification. npm packages can execute lifecycle scripts during installation, so package content executes under the privileges of the user running npm. The additional recommendation to use `--force` weakens npm safeguards and can overwrite existing globally installed files or executable links. Treating this option as a general resolution for file conflicts can hide package collisions or tampering rather than identifying their cause. This is a supply-chain exposure rather than evidence that the named package is currently malicious. Exploitation depends on the registry package, publisher account, resolution process, or retrieved version becoming compromised. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or a subsequently released package version. 2. The compromised package includes a malicious npm lifecycle script or executable. 3. A user follows the documented unpinned global installation command. 4. npm retrieves the attacker-controlled latest version and runs its installation logic. 5. If a conflict occurs, the documented `--force` command may overwrite existing global files or command links. 6. The payload executes with the permissions of the npm process and can affect resources available to that account. ### Impact Assessment Successful exploitation could execute code with the installing u ...[truncated 383 chars]
Remediation
## Remediation Suggestions 1. Pin the CLI to a reviewed version, for example `npm install -g clawhub@VERSION`. 2. Verify the package name, publisher identity, repository, release provenance, and npm integrity metadata before installation. 3. Prefer a project-local installation or an isolated environment over a global installation where practical. 4. Review package lifecycle scripts before installing newly published or unexpectedly changed versions. 5. Replace the routine `--force` recommendation with steps that inspect the conflicting path, confirm ownership, remove only verified stale files, and retry without bypassing safeguards. 6. Explicitly warn users not to run the installation with administrator or root privileges unless a documented and reviewed deployment model requires it. 7. Use a lockfile, trusted internal mirror, or approved-version policy where reproducible installation is required.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:104
Finding
Installation of Registry Skills Without Mandatory Trust or Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:104-116`, with additional examples at `SKILL.md:271-283` and `SKILL.md:312-321` **Vulnerability Type**: Installation of third-party skills selected from registry search results without source review, publisher verification, or version pinning **Risk Level**: Medium ### Complete Code Snippets At `SKILL.md:104-116`: ```markdown #### Problem: Unknown Package Name **Scenario Package not found in npm registry** **Solutions:** 1. Use ClawHub search: `clawhub search "keyword"` 2. Try broader search terms 3. Check if the skill is hosted on ClawHub (OpenClaw's official registry) **Example:** ``` Initial attempt: npm install "find-skills" → 404 Solution: clawhub search "find-skills" → Found "find-skills v0.1.0" Result: clawhub install "find-skills" → Success ``` ``` At `SKILL.md:271-283`: ```bash # User asks: "I need a weather skill for checking forecasts" # Step 1: Search clawhub search "weather" # Step 2: Identify candidate Found: "weather v1.0" - Get current weather and forecasts (no API key required) # Step 3: Install clawhub install "weather" # Step 4: Configure (if needed) # Check README_CONFIG.md for required environment variables ``` At `SKILL.md:312-321`: ```bash # Symptom: "I need an RSS feed parser" - package unknown # Step 1: ClawHub search clawhub search "rss" # Step 2: Identify Found: "rss-parser skill v0.5.0" with description "Parse RSS feeds" # Step 3: Install clawhub install "rss-parser" ``` ### Technical Analysis The documented workflow treats a matching search result and its description as sufficient grounds for installation. It does not require verification of the publisher, source repository, package contents, requested permissions, version, cryptographic digest, or release provenance. Registry search results are not a security boundary. An attacker can potentially publish a similarly named o ...[truncated 1734 chars]
Remediation
## Remediation Suggestions 1. Require verification of the exact skill name, publisher identity, source repository, maintenance history, and registry provenance before installation. 2. Pin installations to a reviewed immutable version or digest rather than resolving the current registry release by name alone. 3. Download and inspect the complete skill package before activation, including instruction files, scripts, configuration, hooks, and dependency manifests. 4. Review requested tools, filesystem access, network access, environment variables, and credential requirements according to least privilege. 5. Warn users about typosquatting, dependency confusion, misleading descriptions, and recently created or unexpectedly transferred packages. 6. Test unknown skills in an isolated environment without production credentials or sensitive files. 7. Maintain an allowlist of reviewed publishers and package versions for automated workflows. 8. Separate search, review, installation, and activation into explicit approval stages instead of proceeding directly from a search result to installation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.