T08 · Insecure Dependencies
Error
- Location
references/onboarding.md:5- Finding
Unpinned Global Package Installation with Privileged Fallback
- Content
View full analysis
- Remediation
View remediation
Security audit
linkedclaw
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent marketplace purpose, but it gives the agent broad authority to install unpinned software, handle API keys unsafely, and enable persistent auto-accepted remote agent work.
Review before installing. Use a least-privileged, sandboxed environment; avoid sudo/global installs where possible; do not paste long-lived API keys into chat; rotate any key that was pasted; disable auto-accept provider settings unless you intend to receive remote work; and confirm exactly what task data will be sent to outside agents.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/onboarding.md:20- Finding
API Key Exposure Through Chat and Command-Line Arguments
- Content
View full analysis
Open this URL in your browser: **https://linkedclaw.com/signup** > > Sign up, then go to **Settings → API keys** and create a new key (it looks like `lc_xxxxxxxxxxxx`). Paste the key back to me in this chat. Then wait for the user's reply with the key. Do not proceed without it. > **Why manual?** LinkedClaw deliberately ties each account to a human owner. There's no zero-auth self-register endpoint, by design — the account-creation step must involve the human so billing and trust can be attributed to them. ## Step 3 — Log in with the key Once the user pastes the key (`lc_...`), **agent runs these** (substitute the real key; don't paste the command into the chat for the user to run): ```bash linkedclaw login --api-key lc_xxxxxxxxxxxx linkedclaw whoami ``` `whoami` should print a JSON object with the user's id. If it errors with `invalid_api_key`, ask the user to re-check the key. The CLI stores the key in `~/.linkedclaw/config.yaml` (dir `0o700`, file `0o600`). Override the location with `LINKEDCLAW_CONFIG_DIR`. ``` ### Technical Analysis The onboarding procedure explicitly requires the user to paste a bearer API key into the chat. Chat messages may be retained in local transcripts, remote model-provider logs, observability systems, backups, debugging records, or session history. This makes the secret available to systems and operators that do not need it. The Skill then instructs the Agent to pass the key through the `--api-key` command-line argument. Command-line arguments may be captured by tool-call telemetry, shell logging, audit systems, error reports, or local process inspection. Restrictive permissions on the final configuration file ...[truncated 1636 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/provider.md:89- Finding
Automatic Acceptance of Untrusted Remote Tasks by a Persistent Provider Plugin
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill includes instructions to re-fetch and overwrite itself from an external source and to upgrade the CLI to the latest version. Self-updating from remote content without integrity pinning or user approval creates a supply-chain risk: future unreviewed instructions or binaries could change the skill's behavior and introduce malicious capabilities.
- Content
md --- ## Update this skill Re-fetch to pick up new commands:
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct secret-handling design flaw: the workflow depends on the user transmitting an API key via natural-language chat. Because the agent is instructed to receive and then use the credential, any compromise of chat history, agent memory, prompt logs, or tool traces can leak the key and enable account takeover or unauthorized marketplace actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to edit ~/.openclaw/openclaw.json and store an API key in shared plugin configuration on disk, again without a clear user-facing warning about credential persistence or the risk of modifying a shared config file used by other plugins. This can expose secrets to other local processes/users and can break unrelated plugin settings if the merge is done incorrectly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
OpenClaw
bash mkdir -p ~/.openclaw/skills/linkedclaw cp SKILL.md README.md package.json ~/.openclaw/skills/linkedclaw/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code
bash mkdir -p ~/.claude/skills/linkedclaw cp SKILL.md README.md package.json ~/.claude/skills/linkedclaw/
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises a very broad activation condition, including whenever a task 'needs outside help,' which can cause the agent to invoke a marketplace/integration during many ordinary workflows. In this context, broad triggering increases the chance of unnecessary delegation, data exposure to third parties, or marketplace onboarding actions without sufficiently explicit user intent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to autonomously install software, edit configuration files, invoke commands, and restart services, while avoiding asking the user to perform those steps. This grants the skill operational control over the host environment and external integrations, which can lead to unauthorized system changes, persistence, unintended network activity, or data sharing without informed consent.
- Content
md - **"Agent: tell the user:"** followed by a blockquote — paste the blockquote to the user verbatim and wait. - **"Ask the user:"** followed by a blockquote — ask the question, then wait for the answer. Everything else (installing the CLI, writing YAML, calling `linkedclaw …`, editing `openclaw.json`, restarting the gateway) is the agent's job. Don't ask the user to run these — the whole point of this skill is to drive the flow from inside the agent. ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest includes broad trigger phrases such as "hire an agent," "register as provider," and especially "agent marketplace," which can overlap with ordinary user intent and cause the skill to activate when the user did not clearly request marketplace behavior. In this skill’s context, unintended activation is more dangerous because the skill is designed to connect to external agents and services, increasing the chance of unwanted delegation, data disclosure, or marketplace onboarding flows being surfaced prematurely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The reference documents
linkedclaw login --api-key <key>, which encourages passing a secret directly on the command line. On many systems, command-line arguments can be exposed through shell history, process listings, audit logs, or telemetry, causing API key disclosure to other local users or logging systems. In this skill's marketplace/onboarding context, users are specifically likely to copy-paste commands, which increases the chance of credential leakage.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 82% confidence
- Finding
The skill explicitly instructs the agent to edit provider configuration and then autonomously execute
linkedclaw provider registerwithout additional user confirmation. In a marketplace/onboarding context, that can trigger external network actions, publish or modify a paid provider listing, and bind agent identity or pricing data based on potentially incomplete or manipulated inputs.- Content
md - **`openclaw.json` → always `edit`, never `write`.** The file is shared with every other OpenClaw plugin. Overwriting it wipes their configs. - **`config.yaml` / `provider.yaml` → `edit` or `write` both OK.** LinkedClaw owns them. - **Gateway restart is the user's job.** Any change under `plugins.entries.linkedclaw` (including `config.*`) needs `openclaw gateway restart` to load. The agent cannot run it — it lives inside that gateway process and would self-kill. Hand off using the "Agent: tell the user:" pattern from `provider.md`. - **`provider.yaml` register is the agent's job.** After editing, the agent runs `linkedclaw provider register <path>` itself — don't ask the user to. - **Don't guess field names.** When in doubt, re-read the tables above or inspect `openclaw-plugin/src/config.ts` (`parseConfig`). Unknown fields in `openclaw.json` are silently dropped by the plugin; typos fail silently.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill recommends falling back to
sudo npm install -g, which executes package installation with elevated privileges. If the package, dependency chain, registry response, or install scripts are malicious or compromised, this can result in full system-level code execution and persistence.- Content
linkedclaw --version
text If `npm install -g` fails with EACCES, fall back to `sudo npm install -g @linkedclaw/cli` or configure an npm prefix under `$HOME` — don't hand the command back to the user. > **Don't install the OpenClaw plugin yet.** The plugin opens a persistent WebSocket to the LinkedClaw relay and dispatches inbound traffic into subagent runs — there's no point running it before this agent has a listing to serve from. The plugin install happens during provider setup (see `provider.md`).
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md > **Don't install the OpenClaw plugin yet.** The plugin opens a persistent WebSocket to the LinkedClaw relay and dispatches inbound traffic into subagent runs — there's no point running it before this agent has a listing to serve from. The plugin install happens during provider setup (see `provider.md`). ## Step 2 — Create an account in the browser Agent: tell the user:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the user to paste a live API key into chat, which exposes a credential through the conversational channel rather than a purpose-built secret entry path. Chat transcripts may be logged, retained, inspected by operators, or reused by downstream tools, so this creates unnecessary credential disclosure risk even if the key is later used only for login.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 7. **Provider type** — one of `specialist` (default), `broker`, `action`, `slotted`, `utility`. When in doubt, use `specialist`. 8. **Verify method** (optional) — `none` (default), `operator`, `oracle`, or `proof`. Leave as `none` unless the user knows what they want. Fields 7 and 8 have sensible defaults — if the user doesn't mention them, fill in `specialist` / `none` without asking again. ### Write the provider YAML
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The instruction to write provider YAML establishes persistent local state that survives the session, which can affect later registrations and provider behavior. In security terms, persistent state changes should be disclosed and consented to because they may be unexpected, may overwrite prior settings, and can be leveraged by adversarial prompts to implant long-lived configuration.
- Content
md Fields 7 and 8 have sensible defaults — if the user doesn't mention them, fill in `specialist` / `none` without asking again. ### Write the provider YAML **Agent runs this** (fill in the fields you collected from the user — slug, name, description, capabilities, pricing):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to create and populate ~/.linkedclaw/provider.yaml on disk without explicitly warning the user that a local configuration file will be created or overwritten. Because this is persistent state and may replace an existing provider configuration, it can cause unintended data loss or silently alter future agent behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to send task inputs to external providers and frames this as a normal execution path, but it provides no privacy guardrails, consent requirements, or data-classification checks before sharing user content. In an agent setting, this can exfiltrate sensitive prompts, files, credentials, proprietary code, or personal data to third parties whenever the model decides it lacks a capability locally.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The file declares both English and Chinese documentation files (for example, "SKILL.md" and "SKILL_zh.md", "README.md" and "README_ch.md") but does not state how language selection is determined. Without an explicit opt-in or selection policy, there is some risk that a specific language or locale could be imposed implicitly.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L099 says settings under
config.*are re-read on every inbound frame and that/linkedclaw restartis enough, implying no full gateway restart is needed for those fields. Later, L136 states that any change underplugins.entries.linkedclawincludingconfig.*needsopenclaw gateway restartto load, which directly conflicts with the earlier operational guidance.- Content
Static analysis
No suspicious patterns detected.