ClawHub
Back to skill

Security audit

PluginEval

Security checks for vulnerabilities and agentic risk

Overview

This skill’s stated purpose is coherent, but its main implementation depends on unpinned external code and standalone instructions tell users to copy external scripts into PATH.

Install only if you trust the plugineval-core package and the referenced repository, and prefer a pinned, verified release. Be cautious with the standalone PATH-copying instructions because they make external scripts available as local commands beyond this skill’s reviewed files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned and Unaudited External Implementation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:25-29
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

markdown
**Required:** `plugineval-core`

```bash
clawhub install plugineval-core
text

Related unsafe source instructions appear in `EXTERNAL.md:15-19`:

```markdown
If running standalone:
1. Clone: https://github.com/Donmeusi/openclaw-config
2. Copy scripts from `scripts/` to your PATH
3. Ensure Python 3.9+ and dependencies are installed

Technical Analysis

The skill does not bundle its substantive evaluation implementation. Instead, it instructs users to install plugineval-core without a pinned version and, alternatively, clone a mutable Git repository and copy scripts into PATH. No immutable commit identifier, package lock, checksum, signature, or integrity-verification procedure is provided.

This creates a supply-chain trust boundary that cannot be audited from the submitted artifact. The downloaded package or repository contents may change after this skill has been reviewed. Copying externally obtained scripts into PATH additionally makes them available as trusted local commands.

Attack Path

  1. An attacker compromises the referenced package, its distribution account, or the remote repository, or introduces a malicious future update.
  2. A user follows the documented instructions and installs the unpinned package or clones the repository's current state.
  3. The user copies the externally sourced scripts into PATH or invokes the installed evaluator.
  4. The attacker-controlled implementation executes with the privileges of the invoking user.
  5. It can inspect supplied skill content, manipulate evaluation results, access user-readable local resources, or perform other commands permitted to that user.

Impact Assessment

Successful exploitation permits arbitrary behavior within the invoking user's privilege ...[truncated 449 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle the required implementation in the audited artifact where practical.
  2. Pin plugineval-core to an exact, reviewed version rather than installing the latest available release.
  3. Pin repository installation instructions to a specific immutable commit hash and verified release tag.
  4. Publish and verify cryptographic checksums or signatures before executing downloaded files.
  5. Use a lockfile or equivalent dependency manifest to pin all transitive dependencies.
  6. Install scripts into an isolated, skill-specific environment rather than copying them into a general-purpose PATH.
  7. Apply least privilege and sandbox the evaluator, restricting filesystem and network access to what the evaluation requires.
  8. Reconcile the conflicting version declarations in SKILL.md, EXTERNAL.md, and _meta.json, and ensure all documented script paths correspond to files actually shipped or immutably referenced.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep