ClawHub
Back to skill

Security audit

Boxed Fetch

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent web-fetching purpose, but it tells users to download and run a mutable remote WASM binary without integrity verification.

Review before installing. Only use this if you are comfortable running a WASM binary fetched from the publisher's GitHub path; prefer a version that bundles the reviewed WASM file or pins it to an immutable release with a published SHA-256/signature. Keep allowedOutboundHosts limited to the exact destination you intend to fetch.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:17
Finding
Unpinned Remote WASM Payload Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-27` and `references/usage.md:15-19` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:17-27`: ```javascript wasm-sandbox-download({ url: "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/boxed-fetch/files/boxed-fetch-component.wasm", dest: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm" }) ``` ```javascript wasm-sandbox-run({ wasmFile: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm", allowedOutboundHosts: ["<target-host>"], args: ["<target-url>"] }) ``` `references/usage.md:15-19`: ```javascript wasm-sandbox-download({ url: "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/boxed-fetch/files/boxed-fetch-component.wasm", dest: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm" }) ``` ### Technical Analysis The Skill instructs users or agents to download an executable WebAssembly component from the mutable `main` branch of an external personal GitHub repository and then execute that component from a locally trusted path. The effective executable payload is not included in the audited project. The instructions do not pin the download to an immutable commit or release and do not provide a cryptographic checksum, signature, trusted provenance record, or reproducible-build verification procedure. The remote binary can therefore change after the Skill itself has been reviewed. This creates a time-of-review versus time-of-use security gap: approving the Markdown files does not establish the integrity or behavior of the WASM binary that a user will subsequently execute. Compromise of the upstream repository, maintainer account, release process, or hosting path could substitute a modified payload. Execution occurs inside a WebAssembly sandbox with an explicit outbound-host allowlist, which limits the likely impact. ...[truncated 1896 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed WASM component inside the Skill package so that the executable artifact is covered by the same audit and release process. 2. If remote download is necessary, reference an immutable commit or versioned release rather than the mutable `main` branch. 3. Publish a trusted SHA-256 or stronger digest and require verification before the component is saved or executed. Abort execution on any mismatch. 4. Prefer cryptographically signed releases and verify the signature against a documented, independently distributed maintainer key. 5. Document artifact provenance, source code, build toolchain, and reproducible-build instructions so users can verify that the binary corresponds to reviewed source. 6. Store verified artifacts under versioned filenames and avoid silently overwriting an existing trusted binary. 7. Keep sandbox permissions minimal: grant only the exact destination host required for each request and expose no filesystem, environment, credential, or process capabilities unless essential. 8. Define a controlled update procedure requiring a new integrity value and security review whenever the WASM component changes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill’s trigger language is broad enough to match many ordinary requests involving URLs, page content, or scraping, which can cause the agent to invoke this capability more often than necessary. Even though the fetch runs in a WASM sandbox and requires allowedOutboundHosts, over-selection increases the chance of unintended network access, privacy issues, or misuse in contexts where a fetch tool was not the safest or narrowest choice.

External Transmission

Medium
Category
Data Exfiltration
Content
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm",
  allowedOutboundHosts: ["https://api.github.com"],
  args: ["https://api.github.com/users/guyoung", "--header", "Accept: application/json"]
})
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm",
  allowedOutboundHosts: ["https://api.github.com"],
  args: ["https://api.github.com/users/guyoung", "--header", "Accept: application/json"]
})
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.