ClawHub
Back to skill

Security audit

YouTube by ClawLink

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed YouTube integration guide that relies on an external ClawLink plugin and OAuth, with write actions described as requiring user confirmation.

Before installing, confirm that clawhub:clawlink-plugin is the intended ClawLink plugin, review the OAuth permissions requested by Google/YouTube, and only approve write actions after checking the previewed target and effect. Revoke the YouTube connection or remove the plugin if you no longer need it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Installation and Allowlisting

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49; repeated at lines 221–222
Vulnerability Type: Unpinned third-party dependency installed from an external package registry
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The installation and gateway restart are repeated in the troubleshooting workflow:

bash
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill instructs users to install clawhub:clawlink-plugin without specifying an immutable version or integrity digest. It then explicitly allowlists that plugin and restarts the OpenClaw gateway, causing the installed component to be loaded.

Because the dependency is mutable and its implementation is outside the audited project, future installations may retrieve code different from the code originally reviewed. A compromise of the package, publisher account, distribution registry, or update channel could therefore introduce malicious behavior without requiring changes to SKILL.md.

The plugin is intended to mediate OAuth-authenticated YouTube operations. Consequently, dependency provenance and integrity are security-sensitive even though the reviewed file contains no embedded malicious code. The documentation’s write-confirmation workflow reduces accidental modifications but cannot protect against a compromised plugin that disregards those controls.

Attack Path

  1. An attacker compromises the plugin publisher, package registry, distribution channel, or another component capable of replacing the mutable clawlink-plugin package.
  2. The attacker publishes a malicious build under the same unversioned package identifier.
  3. A user follows the skill instructions and installs clawhub:clawlink-plugin.
  4. The user allowlists the plugin through `too ...[truncated 1134 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an audited, immutable version rather than installing an unversioned package.
  2. Verify the package with a cryptographic integrity digest or signed provenance record before installation.
  3. Document the expected publisher identity, registry origin, version, checksum, and verification procedure.
  4. Require review or explicit approval before adding the plugin to tools.alsoAllow and restarting the gateway.
  5. Apply least-privilege OAuth scopes so the plugin receives only permissions required for the requested operation.
  6. Separate read-only and write-capable authorization where supported, granting write access only when necessary.
  7. Run the plugin in a restricted sandbox with limited filesystem, network, process, and credential access.
  8. Establish a trusted update policy that reviews new releases before changing the pinned version.
  9. Provide revocation instructions for the plugin authorization and connected Google account tokens.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep