ClawHub
Back to skill

Security audit

Config Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent config-editing helper, but its reference instructions include broad, unverified global tool installation steps that users should review before following.

Install only if you are comfortable reviewing tool installation commands first. Prefer already installed system tools, pinned versions, checksums or signatures, and user-local or virtual-environment installs instead of running the provided sudo, npm -g, pip, or latest-download examples directly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
references/formats.md:69
Finding

Unverified and Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: references/formats.md:28-30, 43, 69-74, 89-91, 130-132, 156
Vulnerability Type: Unsafe installation of mutable third-party dependencies
Risk Level: High

Vulnerable Code

At references/formats.md:28-30:

bash
sudo dnf install jq    # Fedora
sudo apt install jq    # Debian/Ubuntu
brew install jq        # macOS

At references/formats.md:43:

bash
npm install -g ajv-cli

At references/formats.md:69-74:

bash
wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O yq
chmod +x yq
sudo mv yq /usr/local/bin/

# Or via pip
pip install yq

At references/formats.md:89-91:

bash
# Install yamllint
pip install yamllint

At references/formats.md:130-132:

bash
pip install toml
# or
pip install tomli  # Python 3.11+ built-in

At references/formats.md:156:

bash
pip install yq

Technical Analysis

The Skill recommends installing third-party executables and packages without pinning exact versions or verifying artifact integrity.

The most serious instance downloads the yq executable from a mutable latest release URL, marks it executable, and places it in /usr/local/bin using sudo. No cryptographic checksum, signature, immutable version, or provenance verification is performed. Consequently, the downloaded bytes can change after the Skill has been reviewed.

The npm and pip instructions also install mutable package versions from external registries. They do not use lockfiles, hashes, exact versions, isolated environments, or package provenance checks. Global npm installation further increases the affected scope.

This creates a supply-chain trust boundary in which compromise of an upstream project, release account, package registry, dependency, distribution channel, or package name can result in attacker-controlled code being installed and executed locally.

Attack Path

  1. An attacker compromises a referenced upstream release, ...[truncated 2055 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin immutable versions

    • Replace latest URLs with exact release versions.
    • Pin exact pip and npm package versions.
    • Maintain dependency lockfiles where applicable.

  2. Verify downloaded artifacts

    • Download the checksum or signature through a trusted channel.
    • Verify SHA-256 or stronger digests before granting execute permission.
    • Prefer signed releases and validate signatures against a pinned maintainer key.

  3. Avoid privileged global installation

    • Install command-line tools into a user-controlled directory or an isolated project environment.
    • Avoid sudo unless system-wide installation is explicitly required and approved.
    • Do not overwrite an existing executable without confirming its origin and obtaining user consent.

  4. Use isolated dependency environments

    • Install Python dependencies in a virtual environment.
    • Use project-local npm dependencies instead of npm install -g.
    • Use hash-locked dependency installation, such as pip requirements with --require-hashes.

  5. Validate package provenance

    • Confirm the expected publisher, repository, package name, and release metadata.
    • Prefer trusted operating-system repositories where their signing and update model meets the deployment requirements.
    • Review transitive dependencies and use automated dependency vulnerability scanning.

  6. Harden the direct-download workflow

    • Download into a securely created temporary directory.
    • Fail closed if integrity verification does not succeed.
    • Confirm the target architecture and operating system.
    • Inspect whether /usr/local/bin/yq already exists before installation.
    • Document a safe rollback or removal procedure.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 201)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 204)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 207)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 210)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 214)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/formats.md (reported line 318)May include surrounding context.

md
3. **Use tools, not manual edits** - `jq`/`yq` for JSON/YAML
4. **Test after changes** - Load config in application context
5. **Respect workspace boundaries** - Only touch ~/openclaw configs
6. **Never commit secrets** - Use .env for sensitive values, gitignore them

## When to Read references/formats.md

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/formats.md (reported line 15)May include surrounding context.

Tools

bash
# Install jq (if not present)
sudo dnf install jq    # Fedora
sudo apt install jq    # Debian/Ubuntu
brew install jq        # macOS

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/formats.md (reported line 16)May include surrounding context.

Tools

bash
# Install jq (if not present)
sudo dnf install jq    # Fedora
sudo apt install jq    # Debian/Ubuntu
brew install jq        # macOS

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/formats.md (reported line 79)May include surrounding context.

md
# Install yq
wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O yq
chmod +x yq
sudo mv yq /usr/local/bin/

# Or via pip
pip install yq