ClawKB

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:02 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a disclosed ClawKB API guide, but it recommends an optional unpinned plugin that can automatically send conversation content to ClawKB and inject retrieved content into system context.

Install the main skill only if you intend agents to operate a ClawKB server with the token and permissions you provide. Avoid enabling the optional auto-recall plugin for sensitive conversations unless you trust the plugin package, pin or verify its version, trust every configured ClawKB backend, and understand that automatic recall may send message content to those servers and place returned entries into privileged prompt context.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:259

Finding

Unpinned Third-Party Plugin with Privileged Prompt-Context Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 259-270
Vulnerability Type: Unpinned third-party dependency with access to a privileged prompt-building hook
Risk Level: Medium

Vulnerable Code

markdown

## Auto-Recall Plugin (Optional)

By default this skill provides **manual** ClawKB access — the agent must explicitly call the API to search. For **automatic** knowledge recall on every conversation, install the companion OpenClaw gateway plugin:

```bash
openclaw plugins install @hata1234/clawkb-openclaw

What it does:

• Hooks into before_prompt_build — automatically searches ClawKB before the agent sees each message
• Injects relevant knowledge entries into the agent's system context
• Supports multiple ClawKB instances in parallel (e.g. personal KB + company KB + public KB)
• Per-sender token mapping — different users get different access levels, controlled entirely by ClawKB server-side ACL

text

### Technical Analysis

The skill recommends installing `@hata1234/clawkb-openclaw` without pinning a version or providing an integrity digest. The dependency's source is not included in the audited project, so its implementation and future updates cannot be verified here.

The advertised plugin operates through `before_prompt_build` and injects remotely stored ClawKB entries into the agent's system context. This gives the dependency access to a security-sensitive prompt construction stage. Two related risks result:

1. A compromised package, maintainer account, or distribution channel could deliver arbitrary plugin behavior through a later installation or update.
2. If the plugin does not strictly treat retrieved entries as untrusted data, an attacker able to write or modify ClawKB content could place instructions in an entry and have them inserted into a privileged context.

The installation is optional and explicitly disclosed; no evidence in the reviewed files proves that the package is currently malicious. The finding conce
...[truncated 1405 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a reviewed immutable version rather than resolving the latest release.
2. Verify the package with a cryptographic integrity digest, lockfile, signed provenance, or equivalent registry verification.
3. Provide a link to reviewable source code and document the exact audited commit and package version.
4. Run the plugin in a sandbox with minimal filesystem, network, credential, and tool permissions.
5. Store ClawKB tokens in a secret manager, restrict each token to the minimum required ACL, and avoid exposing tokens to unrelated plugin components.
6. Treat all recalled entries as untrusted data. Delimit them from system instructions and explicitly state that their contents must not override system, developer, or user instructions.
7. Sanitize and validate retrieved content before prompt insertion, and require user confirmation before recalled content can trigger consequential tool actions.
8. Restrict which ClawKB instances and entry authors may supply automatically recalled content, and maintain audit logs for retrieval and injection events.
9. Offer manual recall as the secure default and clearly warn users about the additional trust boundary introduced by automatic context injection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

}'

text

Delete uses `DELETE /api/entries/:id` and is typically admin-only.

## Upload Images

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

}'

text

Delete uses `DELETE /api/entries/:id` and is typically admin-only.

## Upload Images

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

BASE_URL="http://localhost:3500"

curl -sS "$BASE_URL/api/auth/register-agent" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "OpenClaw Recon Agent",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly documents an optional plugin that performs automatic ClawKB searches on every conversation turn and injects returned knowledge into system context, but it does not warn that user message content will be transmitted to external services or explain privacy implications. This can cause silent data exfiltration of sensitive prompts or identifiers to one or more ClawKB instances, especially because it supports multiple backends and per-sender token mapping.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

Agent usage example (creating an entry with internal links):

bash

curl -sS "$BASE_URL/api/entries" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{

Static analysis

No suspicious patterns detected.