ClawHub
Back to skill

Security audit

Boxed Fetch

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent web-fetching purpose, but it tells users to download and run a mutable remote WASM binary without integrity verification.

Review before installing. Only use this if you are comfortable running a WASM binary fetched from the publisher's GitHub path; prefer a version that bundles the reviewed WASM file or pins it to an immutable release with a published SHA-256/signature. Keep allowedOutboundHosts limited to the exact destination you intend to fetch.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:17
Finding

Unpinned Remote WASM Payload Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
"], args: [""] }) ``` `references/usage.md:15-19`: ```javascript wasm-sandbox-download({ url: "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/boxed-fetch/files/boxed-fetch-component.wasm", dest: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm" }) ``` ### Technical Analysis The Skill instructs users or agents to download an executable WebAssembly component from the mutable `main` branch of an external personal GitHub repository and then execute that component from a locally trusted path. The effective executable payload is not included in the audited project. The instructions do not pin the download to an immutable commit or release and do not provide a cryptographic checksum, signature, trusted provenance record, or reproducible-build verification procedure. The remote binary can therefore change after the Skill itself has been reviewed. This creates a time-of-review versus time-of-use security gap: approving the Markdown files does not establish the integrity or behavior of the WASM binary that a user will subsequently execute. Compromise of the upstream repository, maintainer account, release process, or hosting path could substitute a modified payload. Execution occurs inside a WebAssembly sandbox with an explicit outbound-host allowlist, which limits the likely impact. ...[truncated 1896 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill’s trigger language is broad enough to match many ordinary requests involving URLs, page content, or scraping, which can cause the agent to invoke this capability more often than necessary. Even though the fetch runs in a WASM sandbox and requires allowedOutboundHosts, over-selection increases the chance of unintended network access, privacy issues, or misuse in contexts where a fetch tool was not the safest or narrowest choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage.md (reported line 61)May include surrounding context.

wasm-sandbox-run({ wasmFile: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm", allowedOutboundHosts: ["https://api.github.com"], args: ["https://api.github.com/users/guyoung", "--header", "Accept: application/json"] })

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage.md (reported line 126)May include surrounding context.

wasm-sandbox-run({ wasmFile: "~/.openclaw/skills/boxed-fetch/files/boxed-fetch-component.wasm", allowedOutboundHosts: ["https://api.github.com"], args: ["https://api.github.com/users/guyoung", "--header", "Accept: application/json"] })

text