ClawHub
Back to skill

Security audit

Apaleo

Security checks for vulnerabilities and agentic risk

Overview

This Apaleo integration is coherent, but it asks users to install and allowlist an unpinned third-party plugin that can use managed OAuth to perform high-impact hotel property and inventory changes.

Install only if you trust ClawLink and are comfortable granting Apaleo OAuth access through it. Prefer minimal Apaleo scopes, separate read-only from administrative access where possible, and require human confirmation before create, delete, archive, reset, clone, or move-to-live operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Plugin Installation and Allowlisting

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-33
Vulnerability Type: Unpinned third-party dependency loaded with integration access
Risk Level: Medium

Vulnerable Code:

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation instructions retrieve clawhub:clawlink-plugin without specifying an immutable version, cryptographic digest, or signature-verification procedure. They then explicitly allowlist the installed plugin and restart the gateway, causing downloaded plugin code to be loaded into the OpenClaw environment.

Because the package reference is mutable, the code executed by future installations can change independently of the reviewed SKILL.md file. A compromise of the package registry entry, publisher account, distribution infrastructure, or a subsequent plugin release could introduce unauthorized behavior. The project does not provide locally reviewable plugin source or integrity metadata that would allow users to verify the downloaded artifact.

The documented integration routes Apaleo operations and managed OAuth through this plugin. Consequently, trust in the external dependency extends to data and operations exposed through the integration.

Attack Path

  1. An attacker compromises the plugin publisher account, registry entry, release process, or package-distribution infrastructure.
  2. The attacker publishes a malicious build under the mutable clawhub:clawlink-plugin identifier.
  3. A user follows the documented installation command and downloads the compromised release.
  4. The subsequent configuration command allowlists the plugin as an available tool.
  5. Restarting the gateway loads and activates the malicious plugin.
  6. The plugin abuses the integration context to inspect accessible data, intercept OAuth-mediated operations, or ...[truncated 937 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a reviewed, immutable version rather than installing a floating package identifier.
  2. Verify the downloaded artifact against a publisher-provided cryptographic digest or trusted digital signature before allowlisting it.
  3. Publish and link the exact corresponding source revision so users can audit and reproducibly build the plugin.
  4. Configure dependency-update monitoring and require security review before changing the pinned version or integrity value.
  5. Grant only the minimum Apaleo OAuth scopes needed for the user's intended operations. Separate read-only and administrative connections where practical.
  6. Enforce explicit, contextual confirmation for every state-changing operation in executable policy rather than relying solely on documentation.
  7. Run the plugin in a restricted environment with limited filesystem, network, credential, and process permissions.
  8. Record and monitor plugin-originated write and delete operations so unauthorized activity can be detected and investigated.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.