ClawHub
Back to skill

Security audit

ClickUp

Security checks for vulnerabilities and agentic risk

Overview

This ClickUp skill is a disclosed ClawLink integration for managing workspace data, with write actions requiring user confirmation.

Install this only if you trust ClawLink and are comfortable granting it access within your connected ClickUp workspace permissions. Review previews carefully before approving create, update, delete, bulk, comment, or chat-message actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:53
Finding

Unpinned Third-Party Plugin Installation and Activation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–57
Vulnerability Type: Unpinned privileged third-party dependency
Risk Level: Medium

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references clawhub:clawlink-plugin without specifying an immutable version, package digest, checksum, or signature verification step. The following command explicitly allowlists the installed plugin, and the gateway restart activates it.

Consequently, the code reviewed during an audit may differ from the code installed later. Although the document describes the plugin as “verified,” that statement does not provide enforceable artifact integrity. If the package registry, publisher account, distribution infrastructure, or latest plugin release is compromised, users following these instructions could install and activate attacker-controlled code.

The plugin is intended to mediate ClickUp operations and managed authentication, so compromise could expose integration data and permit operations within the connected account’s effective authorization scope.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry, release pipeline, or another upstream distribution component.
  2. The attacker publishes or substitutes a malicious release under the same mutable clawhub:clawlink-plugin identifier.
  3. A user or agent follows the documented installation command, which retrieves the current upstream release without pinning or integrity verification.
  4. The plugin is added to tools.alsoAllow, granting it access through the OpenClaw tool configuration.
  5. The gateway is restarted, activating the compromised plugin.
  6. The malicious plugin can process subsequent integration calls and potentially access or manipulate data available through the plugin and connected ClickUp account ...[truncated 563 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an audited, immutable version and, where supported, a cryptographic artifact digest.
  2. Add an explicit signature or checksum verification step before installation and fail closed if verification is unsuccessful.
  3. Obtain the plugin only from an authenticated, trusted registry whose namespace ownership and release provenance can be verified.
  4. Document the precise permissions, data access, and host capabilities granted to the plugin before requesting user approval.
  5. Require separate explicit approval for installation, allowlisting, and gateway restart rather than treating them as one automatic setup sequence.
  6. Apply least privilege to the plugin and connected ClickUp account, restricting workspace permissions to capabilities required for the requested task.
  7. Review and test each new plugin release before updating the pinned version.
  8. Maintain a rollback procedure and audit logs for plugin installation, configuration changes, authentication activity, and ClickUp operations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.