Security audit

smartclaws

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for SmartClaws setup, but its templates and setup flow expose high-impact SmartClaws permissions too broadly for default installation.

Review before installing. Use this skill only with a trusted SmartClaws deployment, add an explicit read/disclosure allowlist before adopting the AGENTS templates, avoid leaving the full smartclaws tool grant enabled after setup, and prefer pinned or otherwise verified plugin and role/device skill versions where your package manager supports it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: templates/AGENTS.controller.md:18
Finding: Encrypted telemetry may be disclosed to unauthorized session participants
Content: View full analysis
(usualy main session) # Everyone else: read-only. ``` The bridge template contains the corresponding disclosure instruction: ```markdown - **Be helpful with reads.** Anyone may get the latest reading / device status unless you have contrary instructions. On an **encrypted** channel, that means `smartclaws_disclose` (plain is `smartclaws_read`). If you may disclose, do it. If this wallet is not a reader, the plugin errors — report that; do not invent permission. If the wallet has no funds, ask the owner to fund it (same as publish). ``` ### Technical Analysis The encrypted-channel reader ACL authorizes the SmartClaws wallet, not every person who can interact with the Agent. The templates distinguish only between users who can perform writes and users who are “read-only.” They then direct the Agent to use its privileged `smartclaws_disclose` capability for anyone requesting status. This creates a confused-deputy authorization ...[truncated 1709 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SETUP.md:70
Finding: Setup enables an excessively broad set of privileged plugin tools
Content: View full analysis
/dev/null)"; then existing='[]'; fi merged="$(node -e 'const current=JSON.parse(process.argv[1]); if (!Array.isArray(current)) throw new Error("tools.alsoAllow is not an array"); console.log(JSON.stringify([...new Set([...current,"smartclaws"])]))' "$existing")" openclaw config set tools.alsoAllow "$merged" --strict-json openclaw gateway restart ``` Prefer the same list on this agent's `tools.alsoAllow` (or the OpenClaw UI/tool policy equivalent) rather than globally. Do not replace other plugins already in the allowlist. ``` The later cleanup instruction is non-enforcing: ```markdown If 1.1 opened all SmartClaws tools for guided setup, remind the owner to review `tools.alsoAllow` (and this agent's tool policy) now and remove anything they do not want left on — especially disclose, register, roles, keys, and backups. ``` ### Technical Analysis Allowlisting the plugin ID enables the complete optional tool set rather than only the operations required for the selected job or current setup phase. The resulting authority can include: - Wallet and HOME initialization. - Group, device, and Agent registration. - Role and reader ACL modification. - Encrypted disclosure. - On-chain publishing and notifications. - Viewing-key management. - ...[truncated 2004 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SETUP.md:48
Finding: Security-sensitive third-party components are installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation guidance says to read the file when 'setting up, onboarding, re-running setup, or you cannot yet say you have everything as this job,' which is imprecise and includes a vague fallback condition. In a markdown skill file, this can create uncertainty about when the setup skill should activate versus when normal operational guidance in SKILL.md should apply.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description contains broad activation language such as triggering when the owner wants to start, set up, onboard, or when the agent cannot yet say it has everything as its job. This can cause the skill to be invoked in loosely related contexts, increasing the chance the agent prematurely enters setup flows, loads additional files, or changes operational state when a narrower informational skill would have been sufficient.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The instruction to continue setup until the agent can truthfully say a subjective readiness sentence creates ambiguous control flow. Because the criterion is self-evaluated and not tied to a verifiable checklist, the agent may over-trigger setup behavior, repeatedly load supporting documents, or transition into privileged role skills without a clear, auditable completion condition.
Content: No source excerpt is available for this finding.