ClawHub
Back to skill

Security audit

GitLab

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed GitLab integration skill, with sensitive GitLab access that fits its purpose but should be installed and used carefully.

Before installing, understand that this enables a third-party ClawLink plugin and connects it to your GitLab account through OAuth. Use a least-privileged GitLab account or scopes where possible, review every preview before write actions, and be aware that archiving is a state-changing action despite one misleading read-only label.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Installation and Enablement

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49; equivalent configuration commands are repeated at lines 283–284
Vulnerability Type: Unpinned third-party dependency loaded into the OpenClaw gateway
Risk Level: Medium

Vulnerable Code Snippet:

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The configuration and restart commands are repeated in the troubleshooting instructions:

bash
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The Skill instructs users to install an executable third-party plugin by package name without specifying an immutable version, cryptographic digest, or explicit signature-verification procedure. It then adds the plugin to the permitted tool list and restarts the gateway, causing the downloaded component to be loaded.

Consequently, the effective executable implementation is not contained in the audited project and may change independently after this SKILL.md file has been reviewed. A compromise of the publisher account, registry, release process, or distribution channel could replace a legitimate plugin release with malicious code.

This finding is limited to supply-chain exposure. The audited file openly discloses that ClawLink handles OAuth credentials and proxies GitLab requests; no evidence in the inspected project proves malicious credential exfiltration or an existing compromise.

Attack Path

  1. An attacker compromises the plugin publisher, package registry entry, release pipeline, or another relevant distribution component.
  2. The attacker publishes a modified clawlink-plugin under the same mutable package reference.
  3. A user follows the Skill's installation command, which does not pin a known-good version or digest.
  4. The user adds the downloaded plugi ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing a mutable package reference.
  2. Verify a publisher signature and cryptographic digest before enabling the plugin.
  3. Publish the expected version, digest, signing identity, source repository, and reproducible-build provenance in the Skill documentation.
  4. Require users to review the plugin's requested permissions and the tools.alsoAllow change before installation.
  5. Apply least privilege by exposing only the GitLab operations necessary for the requested task.
  6. Sandbox the plugin and restrict its filesystem, process, network, credential, and unrelated tool access.
  7. Use narrowly scoped and revocable GitLab authorization, and document token revocation and plugin-removal procedures.
  8. Avoid automatically restarting the gateway until package verification and permission review have completed.
  9. Add integrity monitoring and an update policy that requires renewed review when the pinned plugin version changes.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description for gitlab_archive_project says "Archive a project (read-only)", but archiving a project is a state-changing action and the same row marks the mode as Write. This is active documentation contradiction that could mislead an agent about whether confirmation is required for a destructive or high-impact action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.