T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Plugin Receives Execution and OAuth Mediation Privileges## Vulnerability Details **File Location**: `SKILL.md`, lines 42–48 and 68–80 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code**: ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` The same file states: ```text No API key is required in chat. ClawLink stores the OAuth token securely and injects it into every Calendly API request on the user's behalf. ``` ### Technical Analysis The skill directs users to install `clawhub:clawlink-plugin` without an immutable version, cryptographic checksum, or signature constraint. It then adds the plugin to OpenClaw's allowed tools and restarts the gateway so the newly installed component is loaded. The external plugin subsequently mediates sensitive Calendly OAuth credentials and authenticated API requests. The reviewed project does not include the plugin implementation or identify a reproducible artifact corresponding to a reviewed version. Consequently, the behavior loaded during installation can differ from the behavior originally assessed if the upstream package changes or its distribution channel is compromised. Installation is disclosed and requires user confirmation, so the evidence does not establish malicious intent. The risk arises from granting executable and credential-handling authority to a mutable third-party dependency that cannot be verified from the audited project. ### Attack Path 1. An attacker compromises the plugin publisher, package registry entry, build pipeline, or upstream distribution account. 2. The attacker publishes a malicious release under the referenced mutable `clawlink-plugin` package name. 3. A user follows the skill instructions and installs the package without a pinned version or integrity verification. 4. OpenClaw adds the plugin to its allowlist and ...[truncated 974 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the plugin to an immutable, reviewed version rather than installing a mutable package reference. 2. Verify the package using a publisher signature and a cryptographic digest recorded in the skill. 3. Provide a link to the exact auditable plugin source and reproducible build artifact. 4. Document the precise Calendly OAuth scopes requested and apply least privilege. 5. Restrict the plugin's network access to explicitly approved ClawLink and Calendly endpoints. 6. Isolate OAuth token storage from general plugin execution and prevent tokens from appearing in logs, tool output, or error messages. 7. Preserve the existing requirement for explicit confirmation immediately before every write operation, including destructive actions. 8. Add package provenance checks, update review procedures, and a rollback mechanism for compromised releases.