Security audit

Claw Messenger

Security checks for vulnerabilities and agentic risk

Overview

This skill is for connecting OpenClaw to a messaging service, but it asks users to install an unpinned external plugin and store a live messaging API key locally without enough safeguards.

Review this before installing. Use a pinned, verified plugin version if possible, avoid pasting live API keys into chat, keep .openclaw.json out of source control and readable only by your user account, and assume message content and metadata will pass through the provider's infrastructure.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party Plugin Installation
Content: View full analysis
Remediation: View remediation
``` 2. Verify the package using a cryptographic integrity digest or signed provenance before installation. 3. Publish or vendor the corresponding plugin source so its behavior can be audited together with the Skill. 4. Use a trusted lockfile and a registry configuration that prevents dependency substitution. 5. Review package ownership, release history, lifecycle scripts, transitive dependencies, and requested runtime permissions. 6. Run the plugin with least privilege, restricting filesystem access, environment variables, network destinations, and access to unrelated OpenClaw secrets. 7. Establish an explicit update process in which new versions are reviewed before changing the pinned dependency. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Live API Key Exposed to Conversation Context and Plaintext Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to place a live cm_live_ API key into .openclaw.json and route SMS/iMessage/RCS content through a third-party WebSocket service, but it does not clearly warn about the security and privacy implications of storing a production credential locally or sending message content and metadata off-platform. This can lead users to expose secrets in plaintext config files, backups, logs, or source control, and to unknowingly transmit sensitive communications through an external provider.
Content: No source excerpt is available for this finding.