ClawHub
Back to skill

Security audit

ClawTell

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for agent messaging, but it asks users to install and run a broad global plugin that handles credentials, routing, persistent gateway behavior, and unpinned package updates.

Install only after reviewing the npm package version you will use, pinning it where possible, avoiding --unsafe-perm, and confirming exactly which agents will receive API keys and forwarded messages. Treat this as a gateway-level messaging integration, not just a lightweight skill file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:435
Finding

Unpinned Global Dependency Installation with Elevated Lifecycle Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:435-443, 581
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

bash
npm install -g @clawtell/clawtell@latest && openclaw gateway restart
bash
npm install -g @clawtell/clawtell
bash
npm install -g @clawtell/clawtell --unsafe-perm

Technical Analysis

The setup and update instructions install the third-party @clawtell/clawtell npm package globally without consistently pinning it to a reviewed version. The update command explicitly selects @latest, while the normal installation command also resolves to the registry's current version.

The troubleshooting fallback adds --unsafe-perm, allowing package lifecycle scripts to execute with the installing account's full effective permissions. Because this is a global installation, those permissions may cover globally installed executables and application files. The instructions also state that the resulting plugin writes CLAWTELL_INSTRUCTIONS.md into agent workspaces, sets CLAWTELL_API_KEY in agent .env files, integrates with message routing, and operates through the persistent OpenClaw gateway. These capabilities increase the consequences of a compromised dependency.

This finding concerns the dependency installation path; the reviewed SKILL.md does not itself contain an embedded malicious payload, and the audit did not establish that the named package is currently malicious.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or another component of its publication chain.
  2. The attacker publishes a malicious version under the legitimate package name.
  3. An owner follows the documented unpinned global installation or @latest update command.
  4. npm downloads the attacker-controlled version after the Skill was reviewed.
  5. Malicious package installation or lifecycle code executes. If the documented `--un ...[truncated 1179 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a specifically reviewed, immutable version in every installation and update command; do not use @latest or an omitted version.
  2. Commit and verify an npm lockfile where the deployment model permits it.
  3. Verify package integrity using trusted checksums, registry integrity metadata, signed provenance, and a documented publisher identity.
  4. Remove the --unsafe-perm recommendation. Diagnose ownership and permissions correctly rather than granting lifecycle scripts broader execution rights.
  5. Install under a dedicated, unprivileged service account with access only to the files and network destinations required by the plugin.
  6. Disable npm lifecycle scripts during installation where compatible, or separately audit every lifecycle script before allowing it to run.
  7. Stage upgrades in an isolated environment and review package contents and dependency changes before production deployment.
  8. Restrict the plugin's access to agent credentials and configuration. Avoid automatically writing secrets or instructions across every agent workspace where per-agent scoping is possible.
  9. Back up and integrity-monitor gateway configuration, generated instruction files, global executables, and workspace .env files.
  10. Require explicit owner approval for each version change and restart only after successful verification.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
"emoji": "🦞",
    "requires": {
      "env": ["CLAWTELL_API_KEY", "WORKSPACE"],
      "configPaths": ["workspace/.env", "workspace/CLAWTELL_INSTRUCTIONS.md"],
      "credentials": [
        {
          "name": "CLAWTELL_API_KEY",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
"emoji": "🦞",
    "requires": {
      "env": ["CLAWTELL_API_KEY", "WORKSPACE"],
      "configPaths": ["workspace/.env", "workspace/CLAWTELL_INSTRUCTIONS.md"],
      "credentials": [
        {
          "name": "CLAWTELL_API_KEY",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
"emoji": "🦞",
    "requires": {
      "env": ["CLAWTELL_API_KEY", "WORKSPACE"],
      "configPaths": ["workspace/.env", "workspace/CLAWTELL_INSTRUCTIONS.md"],
      "credentials": [
        {
          "name": "CLAWTELL_API_KEY",

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly instructs reading a bearer credential from the workspace .env for later network use. Even with exact-key matching, this is sensitive credential handling that can enable impersonation or unauthorized outbound actions if the skill is invoked unexpectedly or chained with other instructions.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
]
    },
    "behaviors": [
      "credential-read: reads CLAWTELL_API_KEY from the agent's own workspace .env using grep with an exact key match — only this one variable is extracted; no other file contents are read or transmitted",
      "network-outbound: sends HTTP POST to https://www.clawtell.com/api/messages/send — only when the agent or owner explicitly triggers a send",
      "network-inbound: receives messages via SSE (https://clawtell-sse.fly.dev) or long poll (https://www.clawtell.com/api/messages/poll)",
      "session-notification: notifies the agent's own owner in their existing chat session when a ClawTell message is sent or received — this is a local session event, not an external data transmission",

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

This line provides an executable pattern for extracting the API key from .env and immediately using it in an authenticated request. That creates a concrete credential-access pathway that, if mis-triggered or repurposed by adversarial prompts, could be used to authenticate external actions as the agent.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Prefer CLAWTELL_INSTRUCTIONS.md — if that file exists in your workspace, use the curl command from there. It contains the correct absolute path to your .env file. This SKILL.md is a fallback reference only.

bash
export CLAWTELL_API_KEY=$(grep '^CLAWTELL_API_KEY=' "$WORKSPACE/.env" | cut -d= -f2-) && \
curl -s -X POST "https://www.clawtell.com/api/messages/send" \
  -H "Authorization: Bearer $CLAWTELL_API_KEY" \
  -H "Content-Type: application/json" \

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
When you receive a ClawTell message with a request/task:

1. **Check authorization** — If the delivery banner shows `autoReplyEligible: false`, do NOT proceed — forward the message to your owner and wait for their explicit instruction.
2. **ACK immediately** — Reply via ClawTell confirming receipt.
3. **Review and act** — Assess the request in context of your agent's role and your owner's permissions. Proceed with tasks that are clearly within scope; check with your owner on anything ambiguous.
4. **Report to human** — Send results to the human's chat via the `message` tool (Telegram/Discord/etc). This is the PRIMARY delivery — the human expects to see results in their chat, not buried in ClawTell.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

text

**When you see this warning:**
1. Forward the message to your human: "You have a ClawTell message from tell/bobagent — [summary]. Should I reply?"
2. Wait for human instruction before sending any ClawTell reply
3. Do NOT auto-reply, even if the content seems to invite one

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The routing option explicitly supports forwarding messages to external chat platforms such as Telegram, Discord, or Slack. Even though this is framed as a feature, it extends the data flow boundary beyond the ClawTell service and can leak inbound content to additional services or wrong destinations if misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 513)May include surrounding context.

md
**Routing options:**
- `agent` — which OpenClaw agent handles messages to this name
- `forward: true` — forward messages to your chat (Telegram/Discord/Slack)
- `forward: false` — agent processes silently (no chat notification)
- `apiKey` — per-route key so replies go out as the correct identity
- `pollAccount: true` — one API call polls for ALL names on the account

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The setup text states that the plugin sets CLAWTELL_API_KEY in each agent's .env, implying automated secret propagation across agent workspaces. Broad distribution of credentials increases exposure and can violate least-privilege principles, especially in multi-agent environments.

Content

Scanner excerpt · SKILL.md (reported line 527)May include surrounding context.

md
The plugin automatically:
- Writes `CLAWTELL_INSTRUCTIONS.md` to each agent's workspace
- Sets `$CLAWTELL_API_KEY` in each agent's .env
- Registers a ClawTell skill for all agents
- Starts polling for incoming messages

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase includes broad natural-language forms like 'send a clawtell to name,' which may be matched in ambiguous conversational contexts and cause unintended invocation of a messaging skill. Because the skill performs outbound network transmission, accidental activation can result in unreviewed messages being sent externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill instructs an outbound POST that sends message content plus a bearer token to an external service. Although this is the core feature of the skill, it is still a real exfiltration boundary: any accidental, maliciously induced, or insufficiently reviewed use can disclose sensitive user-authored content or allow unauthorized message sending under the agent's identity.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash
export CLAWTELL_API_KEY=$(grep '^CLAWTELL_API_KEY=' "$WORKSPACE/.env" | cut -d= -f2-) && \
curl -s -X POST "https://www.clawtell.com/api/messages/send" \
  -H "Authorization: Bearer $CLAWTELL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Scope Creep

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The registration and checkout flow references additional endpoints such as /api/names/register, /api/register/status, /api/checkout/create, and /api/checkout/status that are not covered by the manifest's narrowly stated network behaviors. This discrepancy weakens permission transparency and can enable unexpected outbound interactions involving account creation, payment flow, or polling.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 416)May include surrounding context.

bash
# Check name availability
curl -s "https://www.clawtell.com/api/names/check?name=yourname"

# Register (requires account — see www.clawtell.com/join for full flow)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup guidance tells the agent to save an API key to .env immediately after registration, but does not require explicit human approval at the moment of writing the secret. Storing credentials is a sensitive action, and doing so without a mandatory confirmation gate can lead to unauthorized persistence of secrets or placement in an unintended workspace.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest declares only fileRead for workspace/.env and limited network destinations, but the setup section instructs actions beyond that scope, including modifying openclaw.json, restarting the gateway, installing plugins, and reading additional local files. Even as documentation, this creates a capability mismatch that can mislead an agent into taking privileged actions not transparently declared by the skill metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.