Security audit

ClawBond

Security checks for vulnerabilities and agentic risk

Overview

This ClawBond skill is mostly coherent for a social platform, but it gives the agent broad standing authority to post, message, store DM history, and modify local runtime setup with limited confirmation gates.

Install only if you are comfortable granting a social-platform agent broad authority to act for you. Before use, set explicit boundaries for posting, DMs, connection requests, heartbeat automation, local DM retention, plugin installation, QClaw/OpenClaw config edits, and restarts; review messages before publishing when privacy or reputation matters.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file declares and implements a benchmark/evaluation module inside a skill whose stated purpose is social interaction on ClawBond. This capability mismatch is dangerous because it expands the skill's authority into credential use, benchmark orchestration, and result handling that a user invoking a social skill would not reasonably expect.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented behavior grants run creation, artifact upload, finalize, and score retrieval capabilities that are unrelated to the parent social-networking purpose. In context, this hidden functional expansion increases the risk of unauthorized external actions and data transmission under a misleading trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The init/binding module expands beyond authentication setup into plugin installation, editing external runtime configuration, and triggering process restarts. That creates a broader execution and persistence surface than users would reasonably expect from a binding flow, enabling system-affecting actions during what should be a scoped onboarding task.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to modify `openclaw.json` and rewrite `channels.clawbond`, which is an external runtime configuration file outside the narrow ClawBond credential store. Arbitrary local config modification can disrupt unrelated runtime behavior, create persistence, or silently alter how the host system connects to services, especially because the changes are mandated by the skill logic rather than separately authorized.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill directs installation of a plugin and execution of runtime restarts as part of the binding flow, which are privileged host-level actions with security and availability implications. Installing code into the runtime introduces a new execution path and restarting the runtime can interrupt active workloads or apply unreviewed changes without a clearly separated consent step.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger criteria are intentionally expansive, including vague goals like 'benefit from external people, abilities or information' and 'build or maintain social presence' even when the user did not explicitly request outreach. In a skill that can post, DM, recruit, and initiate external contact in full-auto mode, this broad activation scope can cause the agent to take external actions the user did not clearly authorize, creating risks of privacy leakage, unwanted contact, and reputational harm.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt uses very broad language such as 'reach out, post, browse updates, and follow up with other Claws or humans,' which can match many ordinary conversational or information-seeking requests. Because the skill also allows implicit invocation, the agent may activate this external-facing social skill when the user did not clearly intend platform interaction, creating a risk of unintended contact, posting, or disclosure to third parties.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation description references broad benchmark-related phrases such as testing ability, viewing scores, and assessment, which can trigger the module in routine conversation without clear user intent for external benchmark execution. Because the module reads credentials and performs remote API calls, overbroad triggering materially raises the chance of unintended sensitive actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to read a local credential file and use the token for remote benchmark API calls, but does not require a clear user-facing notice or consent step before access and transmission. This is risky because sensitive local secrets are accessed and then used for external operations outside the obvious expectations of a social-platform interaction.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly requires per-conversation history files to be kept indefinitely ('永久保留') and does so for direct messages that may contain personal, operational, or relationship-sensitive data. Permanent local retention without any consent, retention limit, minimization rule, or user-facing warning creates unnecessary privacy exposure and increases the blast radius of host compromise or accidental disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to create `persona.md` from `credentials.json` and `user-settings.json` and to build local conversation files, pulling sensitive identity and preference data into new plaintext artifacts. Creating derived identity/profile files from sensitive sources without a clear warning, consent flow, or access-control guidance expands where sensitive data lives and makes accidental leakage more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to read a token and call a profile endpoint with an Authorization header, then overwrite local persona state, but it does not require an explicit user-facing disclosure at the time of access. In an adversarial or ambiguous runtime, this can normalize silent access to bound-user profile data and credential-backed requests, increasing privacy and consent risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown instructs the agent to change local configuration and restart the runtime without a distinct, explicit warning that host files will be edited and service availability may be impacted. Even if intended for convenience, hidden or bundled system changes reduce user awareness and increase the chance of unsafe modifications being carried out unexpectedly.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger criteria are intentionally broad enough to activate on vague social or exploratory language, which can cause the skill to engage in external-platform actions when the user did not clearly request outreach. In a skill that can post, comment, search for people, and escalate to DM, overbroad activation meaningfully increases the risk of unintended disclosure or unwanted contact.

Vague Triggers

High

Confidence: 99% confidence
Finding: This section explicitly instructs the agent to infer unstated social intent and to both publish a post and search for matching people without requiring an explicit request. Because these are outbound actions on an external platform, inference-based triggering can lead to unauthorized posting, relationship outreach, and disclosure of user interests or plans.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill authorizes autonomous posting unless the user specifically asked for a draft only, which reverses the normal consent model for public communication. Even though posts are marked as agent-authored, publishing on behalf of a person can expose preferences, plans, or sensitive context and create reputational harm if done without a clear pre-send warning and approval.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs automatic DM escalation after comments and states that this should occur without asking the user for permission. Private outreach is more sensitive than public commenting because it can reveal user intent, create ongoing social obligations, and send targeted messages to individuals without informed consent.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: dm/SKILL.md:210

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: social/SKILL.md:26