ClawHub
Back to skill

Security audit

GIPHY

Security checks for vulnerabilities and agentic risk

Overview

The skill’s GIPHY purpose is coherent, but it asks users to install and allowlist an unpinned third-party plugin that handles credentials and persists in OpenClaw.

Review the ClawLink plugin and hosted credential service before installing. Only proceed if you trust ClawLink to handle GIPHY credentials and uploaded media, and consider asking for a pinned plugin version, permission manifest, and clear uninstall/revocation steps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Privileged Third-Party Integration Cannot Be Audited

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49; related credential-proxy behavior at lines 71–77
Vulnerability Type: Unpinned and unauditable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Related authentication instructions:

markdown
**No API key is required in chat.** ClawLink stores credentials securely and injects them into every GIPHY API request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=giphy and connect GIPHY.
4. Call `clawlink_list_integrations` to verify the connection is active.

Technical Analysis

The Skill instructs the user or agent to install clawlink-plugin without pinning an exact version or immutable digest. It then explicitly adds the plugin to OpenClaw's allowed tool set and restarts the gateway.

The plugin implementation, dependency manifest, and permission manifest are not included in the audited project. Consequently, this audit cannot verify:

  • Which plugin version will be resolved at installation time.
  • Whether later installations can resolve to changed code.
  • What local permissions the plugin receives.
  • Which remote endpoints it can contact.
  • How authentication credentials are stored, retained, encrypted, or revoked.
  • Whether proxied request bodies or uploaded assets are logged or forwarded elsewhere.

The documented intermediary behavior is relevant to the Skill's GIPHY functionality: authenticated network requests are necessary to access the API, and uploads inherently transmit user-selected media. Nevertheless, routing credentials and requests through an external service expands the trust boundary beyond a direct GIPHY integrati ...[truncated 2198 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a reviewed, exact version and preferably an immutable cryptographic digest.
  2. Publish or reference reproducible source code corresponding to the pinned artifact.
  3. Verify package signatures and checksums before installation.
  4. Provide a permission manifest documenting local resources, available tools, network destinations, and credential access.
  5. Restrict outbound traffic to explicitly documented ClawLink and GIPHY endpoints.
  6. Separate read-only discovery permissions from upload permissions. Enable write capability only when the user requests an upload.
  7. Preserve the existing preview and explicit-confirmation requirements for every upload.
  8. Document credential encryption, retention, logging, revocation, and incident-response behavior.
  9. Prefer direct GIPHY authentication where feasible. If an intermediary remains necessary, obtain informed user consent explaining that credentials and requests pass through it.
  10. Provide removal and revocation instructions covering plugin uninstall, allowlist removal, session invalidation, and GIPHY credential revocation.
  11. Avoid automatically repeating installation or gateway-modification commands during troubleshooting without first verifying the installed package and configuration state.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.