ClawHub
Back to skill

Security audit

ClickHouse

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClickHouse analytics integration that installs and uses ClawLink to run read-only database queries.

Before installing, use a dedicated ClickHouse account with server-enforced read-only permissions, minimal database/table access, and query/resource limits. Review ClawLink's credential handling and revocation process, because it will store connection details and mediate queries and results.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unaudited Third-Party Plugin Installation and Credential Delegation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49 and 71–77
Vulnerability Type: Third-party dependency and supply-chain exposure
Risk Level: Medium

Complete Code Snippet

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
markdown
**No credentials are required in chat.** ClawLink stores the connection details securely and injects them into every ClickHouse request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=clickhouse and connect ClickHouse.

Technical Analysis

The skill instructs the agent to install executable third-party plugin code from ClawHub, add that plugin to the permitted tool set, and restart the OpenClaw gateway so it becomes active. The plugin implementation and its dependency metadata are not included in the audited project, and the installation command does not pin a reviewed version or verify an integrity hash.

The same workflow delegates storage of ClickHouse connection details and proxying of database requests to the external ClawLink service. Therefore, the audit cannot independently validate the plugin's actual permissions, credential handling, data-retention behavior, request processing, or claimed read-only enforcement.

This is an insecure dependency risk because the package loaded at installation time may differ from the package originally reviewed. A compromised publisher account, registry entry, release pipeline, or later plugin version could introduce malicious behavior. The finding does not establish that ClawLink is malicious; it identifies an unverified supply-chain and trust-boundary exposure.

Attack Path

  1. A user invokes the ClickHouse skill and approves its installation workflow.
  2. OpenClaw download ...[truncated 1610 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin clawlink-plugin to a specific, reviewed version rather than installing an unspecified current release.
  2. Verify the downloaded artifact with a cryptographic digest or signed provenance record before loading it.
  3. Make the plugin source, dependency lockfile, permission manifest, and reproducible build instructions available for review.
  4. Require explicit informed user approval separately for plugin installation, tool allowlisting, gateway restart, account pairing, and credential delegation.
  5. Provision a dedicated ClickHouse account with server-enforced read-only permissions, access only to required databases and tables, query quotas, and resource limits.
  6. Do not rely solely on the proxy's claim that queries are read-only; enforce restrictions at the ClickHouse authorization layer.
  7. Document which credentials and data fields are transmitted, where they are stored, retention periods, subprocess or network privileges, and revocation procedures.
  8. Provide uninstall and rollback instructions that remove the plugin from tools.alsoAllow, revoke its credentials, uninstall the package, and restart the gateway.
  9. Monitor plugin installation and integration activity, and rotate ClickHouse credentials after suspected package or service compromise.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.