ClawHub
Back to skill

Security audit

overwing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent content-safety API helper, but users should understand that checked text and signup credentials are sent to Overwing's external service.

Install only if you are comfortable sending evaluated text to overwing.ai. Use a dedicated API key, avoid reused passwords for signup, do not submit secrets or highly sensitive content unless external processing is acceptable, and pin/review any optional MCP or SDK packages before running them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Chaining Abuse

High
Category
Tool Misuse
Content
code=$(curl -sS -m 60 -o "$tmp" -w '%{http_code}' -X "$method" "$BASE_URL$path" \
      -H "Authorization: Bearer ${OVERWING_API_KEY:-}" -H "Accept: application/json" -H "User-Agent: overwing-skill/1.0 (openclaw)")
  fi
  if [ "${code:0:1}" = "2" ]; then cat "$tmp"; echo; rm -f "$tmp"; return 0; fi
  cat "$tmp" >&2; echo >&2; rm -f "$tmp"; return 1
}
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
code=$(curl -sS -m 60 -o "$tmp" -w '%{http_code}' -X "$method" "$BASE_URL$path" \
      -H "Authorization: Bearer ${OVERWING_API_KEY:-}" -H "Accept: application/json" -H "User-Agent: overwing-skill/1.0 (openclaw)")
  fi
  if [ "${code:0:1}" = "2" ]; then cat "$tmp"; echo; rm -f "$tmp"; return 0; fi
  cat "$tmp" >&2; echo >&2; rm -f "$tmp"; return 1
}
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to execute shell commands such as `scripts/overwing.sh signup/evaluate/batch/usage`, but it does not declare any `permissions` or `allowed-tools` scope. That mismatch can cause an agent platform to expose shell capability implicitly or without clear user review, increasing the chance of unintended command execution, credential handling, or network access.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill recommends `npx -y overwing-mcp`, which fetches and executes the latest package version at runtime without pinning. If the package is compromised, a dependency is hijacked, or a breaking update is published, an agent could run unreviewed code with the agent's local privileges, secrets, and network access.

External Transmission

Medium
Category
Data Exfiltration
Content
local method="$1" path="$2" body="${3:-}" tmp code
  tmp=$(mktemp)
  if [ -n "$body" ]; then
    code=$(curl -sS -m 60 -o "$tmp" -w '%{http_code}' -X "$method" "$BASE_URL$path" \
      -H "Authorization: Bearer ${OVERWING_API_KEY:-}" -H "Content-Type: application/json" -H "Accept: application/json" \
      -H "User-Agent: overwing-skill/1.0 (openclaw)" --data-binary "$body")
  else
Confidence
95% confidence
Finding
This script is designed to send supplied content and authentication material to a remote API via curl. In this skill's context, that means any text passed to evaluate or batch—including potentially sensitive prompts, outputs, or personal data—will be transmitted off-host to an external service, which is a genuine data exposure risk if users or agents do not strictly control inputs.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The signup subcommand transmits a user's email address and password to a remote service to create an account, but the command offers no explicit warning or confirmation at the point credentials are collected and sent. In an agent skill context, this is security-relevant because an automated system could invoke signup with user secrets or reused passwords without the human clearly understanding they are being exfiltrated to a third-party service.

Static analysis

No suspicious patterns detected.