ClawHub
Back to skill

Security audit

Clawatar

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent avatar viewer, but it asks users to install and run mutable unaudited code from a third-party GitHub repository and gives limited disclosure for local voice/WebSocket exposure.

Review before installing. Run it only in a contained environment, do not expose ports 3000 or 8765 beyond localhost, and do not run the install or server with elevated privileges. Verify the external repository revision and npm dependencies before use, and treat voice chat as potentially sending spoken content or transcripts to AI/TTS services.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:13
Finding
Unpinned Third-Party Repository Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–20 **Vulnerability Type**: Unverified remote source and dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Clone and install git clone https://github.com/Dongping-Chen/Clawatar.git ~/.openclaw/workspace/clawatar cd ~/.openclaw/workspace/clawatar && npm install # Start (Vite + WebSocket server) npm run start ``` ### Technical Analysis The installation instructions clone the current state of a mutable third-party Git repository without pinning a reviewed commit, tag, or signed release and without performing an integrity or authenticity check. They then invoke `npm install` and `npm run start` inside the downloaded repository. Because npm lifecycle scripts can execute commands during installation, `npm install` can run code supplied by the remote repository or its dependencies. The effective payload can change after this Skill has been reviewed. A compromised repository, maintainer account, package release, dependency, or dependency resolution process could therefore introduce arbitrary commands without requiring changes to `SKILL.md`. The project contains only `SKILL.md`; the remotely downloaded source, package manifest, lockfile, lifecycle scripts, server implementation, and dependency graph were not included in the audited artifact. Their safety therefore could not be independently verified. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or a dependency resolved during installation. 2. The attacker adds a malicious npm lifecycle script, modifies a dependency declaration, or alters the application startup code. 3. A user follows the Skill instructions and clones the repository's latest mutable state. 4. The user executes `npm install`, which may automatically run attacker-controlled lifecycle scripts. 5. Alternatively or additionally, the malicious payload executes when the user runs `npm run start`. 6. The payload ...[truncated 825 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the repository to a specifically reviewed commit hash rather than cloning the mutable default branch. 2. Prefer a signed, versioned release and verify its cryptographic signature or published SHA-256 checksum before installation. 3. Include a reviewed dependency lockfile and use `npm ci` so dependency resolution is reproducible. 4. Audit all direct and transitive dependencies, including npm lifecycle scripts, before recommending execution. 5. Consider installing initially with `npm ci --ignore-scripts`, then explicitly allow only lifecycle scripts that have been reviewed and are necessary. 6. Document the exact repository revision and dependency versions covered by the security review. 7. Run the application as a dedicated, unprivileged user in a sandbox or container with restricted filesystem and network access. 8. Ensure HTTP and WebSocket listeners bind only to loopback by default and require authentication if they can be exposed beyond localhost. 9. Never run the installation or startup commands with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises a voice chat feature and TTS integration but does not clearly warn that microphone input may be captured and that audio, transcripts, or generated speech requests may be sent to external services such as ElevenLabs. This creates a meaningful privacy and consent risk, especially because users may enable voice features without understanding that sensitive spoken content could leave the local machine.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The installation/startup instructions state that the skill opens a local HTTP interface and a WebSocket control endpoint, but they do not clearly warn that these listeners expose a command surface to other local processes or potentially other hosts if misconfigured. Because the WebSocket endpoint can trigger avatar actions and speech, undocumented exposure increases the chance of unintended access or unsafe deployment assumptions.

Static analysis

No suspicious patterns detected.