Apollo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.6

Overview

The skill is coherent for Apollo sales workflows, but it asks users to install and allowlist an unpinned third-party credential-handling plugin that can perform Apollo reads and writes.

Review the ClawLink plugin publisher, version, and permissions before installing. This skill should only be used if you are comfortable letting ClawLink store or proxy your Apollo API access and perform confirmed Apollo CRM writes through the installed plugin.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Third-Party Plugin Is Installed and Granted Tool Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47–49 **Vulnerability Type**: Unpinned and externally hosted dependency **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ### Technical Analysis The skill instructs users to install `clawlink-plugin` from ClawHub without specifying an immutable version, package digest, or verified signature. It then adds the plugin to OpenClaw's tool allowlist and restarts the gateway, causing the downloaded component to be loaded. The repository contains only `SKILL.md`; it does not include the plugin source code, a dependency lock file, a cryptographic checksum, or other material that would allow the installed implementation to be compared with a reviewed version. Consequently, the effective behavior may change independently of this skill after review. This creates a supply-chain weakness: compromise of the package, publisher account, registry, or mutable package release could cause users to install behavior different from what was originally assessed. The risk is amplified because the plugin is deliberately allowlisted and acts as an intermediary for Apollo data and authenticated requests. The documentation states that ClawLink stores and injects the Apollo API key, although the artifact provides no evidence that the current plugin steals credentials or performs undisclosed data exfiltration. ### Attack Path 1. An attacker compromises the ClawHub package, its publisher account, its distribution channel, or another mutable release mechanism associated with `clawlink-plugin`. 2. The attacker publishes a modified plugin under the same unversioned package identifier. 3. A user follows the installation instructions and receives the compromised release because no immutable version or digest is required. 4. The configuration command adds the plugin to `t ...[truncated 1031 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to an immutable, security-reviewed version rather than installing an unresolved latest release. 2. Verify the package with a cryptographic digest or trusted publisher signature before installation. 3. Publish or link to the exact source revision corresponding to the pinned release so its behavior can be independently audited. 4. Document the minimum permissions required by the plugin and grant only those permissions instead of broadly allowlisting capabilities. 5. Require explicit user approval after presenting the plugin version, publisher identity, integrity information, and requested permissions. 6. Maintain a reviewed version allowlist and reject installation if the downloaded package does not match the approved digest. 7. Define an update process that requires renewed security review rather than silently accepting mutable package updates. 8. Document credential storage, encryption, retention, revocation, and request-proxying controls for the ClawLink trust boundary. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

| Tool | Description | Mode |
|------|-------------|------|
| `apollo_create_task` | Create a task for a contact | Write |
| `apollo_search_tasks` | Search tasks by keywords, date, priority, or assignee | Read |
| `apollo_create_call_record` | Log a call record from an external system | Write |
| `apollo_update_call_record` | Update a call record | Write |

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.