ClawTopics Embedded Link

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.6

Overview

The skill is purpose-aligned for installing and managing a ClawTopics OpenClaw plugin, but its installer and restart helper have material security weaknesses around cache handling, endpoint validation, and private-key file permissions.

Install only if you trust the OpenClaw host environment and can review the effective plugin configuration. Before use, ensure the Gateway runs as its normal owner, the connector identity file is private to that account, the control API endpoint is exactly the intended HTTPS ClawTopics endpoint, and the cache directory cannot be controlled by other local users. Expect one persistent cloud plugin and, when authorized, one safe Gateway restart.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-or-upgrade.mjs:41

Finding

Shared cache directory permits a symlink race during artifact download

Content

View full analysis

path.resolve(value)))]) { if (await writableDirectory(candidate)) return candidate; } throw new InstallError('No writable bounded plugin cache', 'PLUGIN_LOCAL_CACHE_UNAVAILABLE'); } ``` ```js async function downloadArtifact(targetPath, fetchImpl = fetch) { if ((await optionalSha256(targetPath)) === ARTIFACT_SHA256) return targetPath; const partPath = `${targetPath}.part`; await rm(partPath, { force: true }); let lastError; for (let attempt = 1; attempt <= 3; attempt += 1) { try { const response = await fetchImpl(ARTIFACT_URL, { redirect: 'follow', signal: AbortSignal.timeout(30_000), }); if (!response.ok) throw new Error(`download returned HTTP ${response.status}`); const bytes = Buffer.from(await response.arrayBuffer()); if (bytes.length === 0 || bytes.length > MAX_ARTIFACT_BYTES) { throw new Error('downloaded artifact size is outside bounds'); } const hand ...[truncated 3056 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gateway-restart.mjs:299

Finding

Connector signing private key may be accepted with world-readable permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-or-upgrade.mjs:323

Finding

Plugin may remain enabled with an untrusted or plaintext control endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs the agent to run local Node scripts, write restart-plan files, access environment-derived state directories, and invoke shell commands, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization gap where a host agent may execute powerful filesystem and shell actions without an explicit least-privilege contract, increasing the risk of unintended command execution or broader access than the user expected.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- Never expose an Enrollment Code, Gateway credential, private key, ticket,
  route key, device token, or conversation frame in argv, logs, or responses.
- Never auto-approve an OpenClaw device request.
- Never use Docker, systemd, supervisor, OS signals, `gateway stop/start`,
  re-enrollment, or re-pairing as a restart fallback.
- The bundled installer may use `plugins install npm-pack:<verified-local-tgz>

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L130 hard-codes the button text 我已重启，继续检查, requiring Chinese for a user-facing interaction. The file does not offer an alternative language or indicate that the skill is region-specific, so this appears to violate the language/locale policy constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code emits the manual action label "我已重启，继续检查" as the only user-facing language option. That forces a specific locale on users without opt-in or fallback, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.