ClawHub
Back to skill

Security audit

EASA Regulatory Search

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for EASA regulatory lookup, but its setup instructions tell users to run unpinned scripts from a mutable GitHub checkout.

Review the GitHub repository and pin a trusted commit before running the bootstrap scripts. Install and ingestion commands should be run only when you intend to create or update the local EASA corpus, especially faq-all because it crawls many EASA FAQ pages.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/runtime-setup.md:11
Finding

Mutable Remote Repository Is Cloned and Its Scripts Are Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/runtime-setup.md:11-14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/dmoraine/clawEASA.git
cd clawEASA
./scripts/bootstrap-local-runtime.sh
./scripts/install-openclaw-skill.sh

Technical Analysis

The documented installation procedure clones the current default branch of a remote GitHub repository and immediately executes two scripts from that checkout. It does not pin an immutable commit or release, verify a cryptographic checksum or signature, or provide the scripts within the audited artifact.

Consequently, the effective code executed by users can change after this skill package has been reviewed. The referenced bootstrap scripts, dependency declarations, and lockfiles are absent from the audited project, so their behavior and transitive dependencies cannot be verified from this artifact.

This creates a remote code-execution supply-chain boundary: anyone able to alter the upstream repository or its distribution path could change either script and have the modified payload executed by users following the documented setup.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch.
  2. The attacker inserts malicious commands into scripts/bootstrap-local-runtime.sh, scripts/install-openclaw-skill.sh, or content invoked by those scripts.
  3. A user follows the installation instructions and clones the mutable default branch.
  4. The user executes both downloaded scripts without performing an integrity or source review.
  5. The malicious commands run with the privileges and environment access of the installing user.

Impact Assessment

Successful exploitation permits arbitrary command execution with the installing user's privileges. Depending on that user's permiss ...[truncated 431 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the clone to a reviewed, immutable commit hash rather than relying on the repository's mutable default branch.
  2. Publish signed releases and verify the release signature or a trusted cryptographic checksum before executing any downloaded content.
  3. Include the required installation scripts, dependency manifests, and lockfiles in the auditable skill distribution where feasible.
  4. Display or review downloaded scripts before execution, and avoid combining remote retrieval with immediate script execution.
  5. Pin all Python and system dependencies to reviewed versions with hashes, then verify them during installation.
  6. Run bootstrap operations with the least-privileged account possible and avoid requesting administrator or root access.
  7. Add automated integrity checks that fail closed if the checked-out revision or script hashes differ from approved values.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description presents the skill as querying a local claw-easa index for regulatory retrieval. However, the same skill documentation later exposes network-backed capabilities such as ear-discover, ingest fetch, faq-all, and faq-discover, which discover, download, and crawl content from the EASA website rather than only querying local data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The stated purpose is local regulatory lookup and search, but the documented ingest faq-all capability crawls every EASA FAQ sub-domain and faq-discover enumerates remote domains. That content acquisition capability is materially broader than answering questions against an existing local index and is not justified by the manifest's narrow retrieval-focused description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/usage.md (reported line 85)May include surrounding context.

Copy the packaged skill directory into the OpenClaw workspace:

bash
mkdir -p ~/.openclaw/workspace/skills/claw-easa
rsync -a --delete skill/claw-easa/ ~/.openclaw/workspace/skills/claw-easa/

Static analysis

No suspicious patterns detected.