ClawHub
Back to skill

Security audit

openclaw-smartpi

Security checks for vulnerabilities and agentic risk

Overview

This SmartPi skill is a disclosed local troubleshooting workflow with expected install and device-management actions that require user confirmation.

Before approving installation or repair, confirm the OpenClaw plugin source, publisher, and version for openclaw-smartpi. Treat device removal, config changes, and Gateway restart as real local state changes, and approve them only when they match the SmartPi task you requested.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:186
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 186–195
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
1. Check plugin status:

```bash
openclaw plugins list
  1. If the plugin is not installed, obtain user confirmation and execute:
bash
openclaw plugins install openclaw-smartpi
text

### Technical Analysis

The Skill directs the Agent to install `openclaw-smartpi` using only an unqualified package name. It does not pin an audited version, identify an authenticated registry or publisher, verify a cryptographic checksum or signature, or require inspection of the resolved package before installation.

User confirmation reduces the likelihood of an unexpected state change, but it does not establish the integrity or authenticity of the downloaded code. The resulting plugin is expected to load into the OpenClaw Gateway, expanding the trusted computing base with code that is not included in this audit.

This is a supply-chain weakness rather than evidence that the named plugin is malicious. The external plugin's implementation was not present in the audited project and therefore could not be evaluated.

### Attack Path

1. An attacker compromises the package publisher or registry account, replaces a release, or causes the unqualified name to resolve to an attacker-controlled package.
2. A user asks the Agent to install or repair SmartPi support.
3. The Skill checks the plugin state and asks the user to approve installation.
4. After approval, the Agent executes:
   ```bash
   openclaw plugins install openclaw-smartpi
  1. OpenClaw downloads and installs the dependency without a required version, digest, or signature check defined by the Skill.
  2. The Gateway loads the substituted plugin, allowing its code to execute with the privileges available to the plugin process.

Impact Assessment

Successful exploitation could permit arbitrary code exe ...[truncated 577 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specifically reviewed plugin version rather than using an unqualified package name.
  2. Specify the approved registry, repository, and publisher identity.
  3. Verify a cryptographic digest or trusted package signature before installation.
  4. Require the Agent to display the resolved package source, publisher, exact version, and integrity value before requesting user approval.
  5. Fail closed if the resolved source or integrity information differs from the approved values.
  6. Test the pinned package in a restricted environment before production deployment.
  7. Run the plugin with least privilege and limit its access to credentials, configuration, files, and network destinations.
  8. Document rollback procedures and retain the previously trusted package version so a compromised release can be removed promptly.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.