Exist

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Exist health-data integration, but users should understand that it enables a third-party OAuth plugin to access sensitive wellness data.

Before installing, verify you trust ClawLink and the clawlink-plugin source, connect only the Exist OAuth scopes you need, require confirmation for write or release actions, and know how to revoke the Exist OAuth grant and remove the enabled plugin later.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Third-Party Plugin Handles Sensitive Health Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–40
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The plugin's security-sensitive role is further documented at lines 50–52:

markdown

## Authentication

ClawLink handles OAuth with Exist. No API keys needed. Connect at [claw-link.dev/dashboard?add=exist](https://claw-link.dev/dashboard?add=exist). Granted OAuth scopes determine which attribute fields are returned.

Technical Analysis

The installation command references clawhub:clawlink-plugin without pinning an immutable version or cryptographic digest. The subsequent configuration explicitly permits the plugin, and the gateway restart activates it.

Because the plugin mediates OAuth and operations involving sensitive health and fitness information, compromise of the mutable package distribution channel or a future package release could introduce malicious behavior after this Skill has been reviewed. The plugin implementation is not included in the audited project, so its integrity and runtime behavior cannot be verified from the available source.

This is a supply-chain risk rather than evidence that the current plugin is malicious. The affected trust boundary includes OpenClaw plugin execution, OAuth-mediated Exist access, and the health data exposed by the user's granted scopes.

Attack Path

1. An attacker compromises the plugin publisher account, package registry, distribution infrastructure, or an update released under the mutable package identifier.
2. A user follows the documented installation command, which resolves and installs the attacker-controlled release.
3. The user adds clawlink-plugin to the permitted tool list and restarts the gateway.
4. The compromised plugin executes with the permissions availabl ...[truncated 1048 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than installing through a mutable package identifier.
2. Where supported, pin and verify a cryptographic digest so the installed artifact exactly matches the audited artifact.
3. Require package signatures and verify the expected publisher identity and provenance before installation.
4. Publish the plugin source, permission manifest, release hashes, and reproducible-build instructions for independent review.
5. Apply least privilege to plugin permissions and OAuth scopes, granting only the Exist data access required for the user's requested operation.
6. Separate read-only capabilities from write and ownership-management capabilities; keep explicit confirmation mandatory for all mutations.
7. Monitor dependency advisories and package ownership changes, and require review before upgrades.
8. Document ClawLink's handling, storage, retention, and onward transfer of OAuth tokens and health data.
9. Provide a revocation procedure covering the Exist OAuth grant, ClawLink connection, and locally enabled plugin.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

## Security & Permissions

- **Read** tools are safe and require no confirmation
- **Write** tools (acquire/increment/release ownership) require confirmation
- Releasing ownership is high-impact and stops data flow for that attribute

Static analysis

No suspicious patterns detected.