ClawFinder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:24 AM UTC
• Version: 1.0.7

Overview

The skill is coherent for registering and transacting with ClawFinder agents, but it delegates trust to mutable global CLIs and includes irreversible account deletion without a clear confirmation requirement.

Review before installing. Use a pinned and verified CLI version where possible, avoid running account deletion unless the user has just confirmed that exact irreversible action, and treat payment or wallet steps as requiring explicit user approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of Third-Party npm Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 28-32
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

install:
  - kind: node
    package: "@kolegaai/clawfinder"
    bins:
      - clawfinder

markdown

- Install the CLI globally:

  ```
  npm install -g @kolegaai/clawfinder
  ```

The same pattern also appears for optional payment tooling at lines 486-490:

markdown

### Installing lobster.cash

- **OpenClaw agents**: install the lobster.cash plugin.
- **All other agents**: install via the CLI: [`@crossmint/lobster-cli`](https://www.npmjs.com/package/@crossmint/lobster-cli).

Technical Analysis

The Skill instructs users to globally install @kolegaai/clawfinder without selecting an exact, previously audited version or verifying package integrity. It also recommends the unpinned @crossmint/lobster-cli package for payment operations.

An unversioned npm installation normally resolves to the registry's current release. Consequently, the installed code can change after this Skill has been reviewed. npm packages may execute lifecycle scripts during installation with the permissions of the invoking user. A compromised publisher account, malicious package release, registry incident, or transitive dependency compromise could therefore turn the documented installation step into arbitrary local code execution.

Although the document states that the package is built from a public repository, the installation command does not technically enforce a correspondence between the reviewed source and the downloaded artifact. The artifact under audit contains only SKILL.md, so the packages' implementations and provenance claims could not be independently verified.

Attack Path

1. An attacker compromises a package publisher, release process, registry entry, or transitive dependenc ...[truncated 1525 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm dependency to an exact audited version, for example:

   bash

   npm install -g @kolegaai/clawfinder@<audited-exact-version>
   

2. Pin @crossmint/lobster-cli independently to an exact audited version rather than directing users to an unqualified package name.

3. Publish expected package integrity hashes and verify downloaded artifacts against them before installation.

4. Require verifiable npm provenance or signed release artifacts and document how users can validate the package against the referenced source repository.

5. Prefer a project-local or isolated installation over global installation to reduce scope and make dependency state reproducible.

6. Inspect package contents and dependency trees before upgrades. Consider initially downloading with lifecycle scripts disabled, auditing the artifact, and only then permitting required installation behavior.

7. Establish an explicit upgrade process in which each new package version and its transitive dependencies are reviewed before changing the pinned version.

8. Apply additional review and transaction safeguards to the payment CLI because compromise of financial tooling can alter recipients, amounts, signing requests, or reported transaction status.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents clawfinder agent delete as a permanent, irreversible action but does not instruct the agent to require an explicit user confirmation step immediately before executing it. In an agent setting, that omission can lead to accidental or socially engineered account deletion if the model treats a casual request as authorization to run the destructive command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.