ClawHub
Back to skill

Security audit

Proactive Claw Integrations

Security checks for vulnerabilities and agentic risk

Overview

The skill is largely coherent, but it includes a persistent background scheduler and sensitive calendar/context integrations that deserve user review before installation.

Review this before installing if you do not want a background job running every 15 minutes. Enable only the integrations you need, avoid the daemon installer unless you want persistent automation, confirm what the core daemon.py does, and treat calendar/event titles and Notion/GitHub metadata as sensitive local data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
scripts/install_daemon.sh:24
Finding

User-Level Persistent Scheduled Execution

Content
View full analysis
"$PLIST" << EOF ... ProgramArguments $PYTHON $SKILL_DIR/scripts/daemon.py StartInterval 900 RunAtLoad ... EOF # Unload if already running launchctl unload "$PLIST" 2>/dev/null || true # Load launchctl load "$PLIST" ``` ```sh cat > "$SERVICE" << EOF [Unit] Description=OpenClaw Proactive Agent After=network.target [Service] Type=oneshot ExecStart=$PYTHON $SKILL_DIR/scripts/daemon.py StandardOutput=append:$SKILL_DIR/daemon.log StandardError=append:$SKILL_DIR/daemon.log Environment=HOME=$HOME EOF cat > "$TIMER" << EOF [Unit] Description=Run OpenClaw Proactive Agent every 15 minutes [Timer] OnBootSec=2min OnUnitActiveSec=15min Unit=openclaw-proactive-claw.service [Install] WantedBy=timers.target EOF systemctl --user daemon-reload systemctl --user enable --now openclaw-proactive-claw.timer ``` ### Technical Analysis The installer creates and immediately activates a persistent user-level launchd agent on macOS or a systemd user timer on Linux. The configured process runs after login or boot and every 15 minutes thereafter. Periodic background execution is consistent with the declared daemon functionality, and the persistence is disclosed to the user. Nevertheless, it crosses session boundaries and executes a Python file from a fixed, user-writable workspace path. The referenced `daemon.py` belongs to the separately installed core Skill and is absent from this artifact, so its behavior and integrity cannot be verified by this audit. No administrative or system-wide privilege escalation occurs: the generated service runs with the current user's privileges. However, any later malicious replacement of ...[truncated 961 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/cross_skill.py:104
Finding

Untrusted External Titles Inserted into Agent Context

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/team_awareness.py:41
Finding

Sensitive Calendar Metadata Stored Without Enforced File Permissions

Content
View full analysis
sqlite3.Connection: conn = sqlite3.connect(str(DB_FILE)) conn.row_factory = sqlite3.Row conn.executescript(SCHEMA) conn.commit() return conn ``` ```python conn.execute(""" INSERT OR REPLACE INTO team_events (member_email, event_id, event_title, event_start, event_end, is_all_day, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?) """, (email, event_id, title, start, end_dt, is_all_day, now_iso)) ``` ### Technical Analysis The integration stores team-member email addresses, calendar identifiers, event identifiers, event titles, and event times in `memory.db`. The database is opened with the ordinary SQLite API, but the code does not explicitly create it with mode `0600`, verify its resulting permissions, or enforce restrictive permissions on the parent directory. Consequently, confidentiality depends on permissions ...[truncated 1139 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (42)

Tainted flow: 'req' from os.environ.get (line 112, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 121)May include surrounding context.

python
"Notion-Version": "2022-06-28",
            }
        )
        resp = json.loads(urllib.request.urlopen(req, timeout=8).read())
        results = resp.get("results", [])
        if not results:
            return {}

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The declared description does not fully match the observed behaviors and referenced integrations, including local state read/write and checks for additional integrations beyond those described. Behavior/description drift is dangerous because reviewers may approve the skill based on incomplete expectations, while hidden persistence or broader cross-skill interaction can expand data exposure and execution scope.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 14)May include surrounding context.

md
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 6)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 13)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 17)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 27)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 44)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 49)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 59)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 75)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 164)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 171)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 180)May include surrounding context.

sh
# NOT USED BY DEFAULT SETUP — THIS IS AN OPTIONAL HELPER ONLY
# setup.sh does NOT call this script. Most users don't need it.
# Use this ONLY if you want clawhub.ai to provide your Google
# OAuth credentials.json instead of downloading it yourself from
# Google Cloud Console.
# ============================================================
#

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/optional/setup_clawhub_oauth.sh (reported line 22)May include surrounding context.

sh
#   NOT your calendar data, and NOT any personal information.
#
# WHAT IS NOT FETCHED:
#   - token.json (your Google access token — generated locally, never leaves your machine)
#   - Any calendar events or personal data
#
# HOW TO VERIFY:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises executable install steps and references scripts with network, file, environment, and shell capabilities, but it does not declare any explicit tool scope or permissions boundary. This creates a trust and review gap: users and hosting platforms cannot easily determine what powers the skill needs before enabling it, increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation mentions external-service integrations and a background daemon installer but does not clearly warn that data may be transmitted off-host or that the system may be modified for persistent execution. In this skill context, that omission is more dangerous because the add-on explicitly targets privacy-focused deployments, so understated network and persistence risks can mislead operators into enabling sensitive functionality without informed consent.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 6)May include surrounding context.

python
cross_skill.py — Event prep context fetcher (GitHub PRs + Notion pages).

Fetches read-only context to enrich meeting prep check-ins. This file does NOT
read other skills' credentials, config files, tokens, or stored data. It only:
  1. Checks if a SKILL.md file exists for "github" or "notion" (presence check only,
     file is NOT read — used to decide whether to attempt the integration).
  2. Calls the `gh` CLI for open PRs/issues (your existing gh auth, read-only).

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 10)May include surrounding context.

md
Receives: PR/issue titles, states, URLs only. No data written back.
     Gated by: gh CLI installed + authenticated AND github SKILL.md present locally.

  2. get_notion_context(): POST https://api.notion.com/v1/search
     READ-ONLY. Sends: NOTION_API_KEY env var (Bearer token) + event title (first 50 chars).
     Receives: matching page titles and URLs only. No data written back.
     Gated by: NOTION_API_KEY env var set AND notion SKILL.md present locally.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 19)May include surrounding context.

python
Receives: PR/issue titles, states, URLs only. No data written back.
     Gated by: gh CLI installed + authenticated AND github SKILL.md present locally.

  2. get_notion_context(): POST https://api.notion.com/v1/search
     READ-ONLY. Sends: NOTION_API_KEY env var (Bearer token) + event title (first 50 chars).
     Receives: matching page titles and URLs only. No data written back.
     Gated by: NOTION_API_KEY env var set AND notion SKILL.md present locally.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 113)May include surrounding context.

python
Receives: PR/issue titles, states, URLs only. No data written back.
     Gated by: gh CLI installed + authenticated AND github SKILL.md present locally.

  2. get_notion_context(): POST https://api.notion.com/v1/search
     READ-ONLY. Sends: NOTION_API_KEY env var (Bearer token) + event title (first 50 chars).
     Receives: matching page titles and URLs only. No data written back.
     Gated by: NOTION_API_KEY env var set AND notion SKILL.md present locally.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 62)May include surrounding context.

python
"""Pull recent GitHub activity relevant to the event."""
    try:
        # Recent PRs
        result = subprocess.run(
            ["gh", "pr", "list", "--limit", "5", "--json",
             "title,state,updatedAt,url,reviewDecision"],
            capture_output=True, text=True, timeout=10

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cross_skill.py (reported line 70)May include surrounding context.

python
prs = json.loads(result.stdout) if result.returncode == 0 else []

        # Recent issues assigned to me
        result2 = subprocess.run(
            ["gh", "issue", "list", "--assignee", "@me", "--limit", "5",
             "--json", "title,state,updatedAt,url"],
            capture_output=True, text=True, timeout=10

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Defining a LaunchAgents plist path under the user's home directory is part of creating a persistent launchd job. In this context, the script is preparing automatic background execution on macOS, which is a persistence behavior that increases attack surface if the referenced daemon or skill files are altered later.

Content

Scanner excerpt · scripts/install_daemon.sh (reported line 19)May include surrounding context.

sh
echo ""

if [ "$PLATFORM" = "Darwin" ]; then
  PLIST_DIR="$HOME/Library/LaunchAgents"
  PLIST="$PLIST_DIR/ai.openclaw.proactive-claw.plist"

  mkdir -p "$PLIST_DIR"

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

This line names the macOS launch agent plist used for persistence. In a skill installer, establishing a named autorun artifact is security-significant because it survives the initial setup and repeatedly invokes local code.

Content

Scanner excerpt · scripts/install_daemon.sh (reported line 20)May include surrounding context.

sh
if [ "$PLATFORM" = "Darwin" ]; then
  PLIST_DIR="$HOME/Library/LaunchAgents"
  PLIST="$PLIST_DIR/ai.openclaw.proactive-claw.plist"

  mkdir -p "$PLIST_DIR"

Static analysis

No suspicious patterns detected.