ClawHub
Back to skill

Security audit

Google Chat

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly sets up Google Chat access through ClawLink and discloses the main read/write risks, with confirmation required for writes.

Before installing, understand that this connects a hosted ClawLink service to your Google Chat account and enables a plugin that can read accessible Chat data and perform Chat write actions after confirmation. Prefer a pinned or verified plugin release when available, and only connect accounts whose Chat access you are comfortable exposing to this integration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Installation and Allowlisting

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49
Vulnerability Type: Unpinned executable dependency from an external package registry
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The allowlisting and restart commands are also repeated in the troubleshooting instructions at SKILL.md:268-269.

Technical Analysis

The installation command identifies clawlink-plugin only by its mutable package name. It does not specify an audited version, immutable digest, signature, checksum, or other integrity constraint. The subsequent commands add the installed plugin to OpenClaw's allowed tools and restart the gateway so that it becomes active.

Because the reviewed project contains only SKILL.md and does not include the plugin's implementation, the plugin's effective behavior cannot be verified from this artifact. A future package update, compromised publisher account, or compromised distribution channel could therefore cause users following these instructions to load code that differs from the code originally reviewed.

This is a supply-chain risk rather than evidence that the current external package is malicious.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry, release process, or another relevant distribution component.
  2. The attacker publishes a modified package under the mutable clawlink-plugin identifier.
  3. A user or agent follows the documented installation command without an immutable version or digest.
  4. OpenClaw retrieves and installs the attacker-controlled package.
  5. The configuration command allowlists the plugin.
  6. The gateway restart activates the installed plugin.
  7. The plugin executes within its granted OpenClaw environment and may misuse exposed integration capabilities or ac ...[truncated 728 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specific, audited release rather than installing a mutable package name.
  2. Prefer an immutable artifact digest and verify it before installation.
  3. Require cryptographic package signatures and validate the publisher identity and signature chain.
  4. Record the expected version, digest, provenance, and review date in the Skill documentation.
  5. Review the plugin implementation and its transitive dependencies before allowlisting it.
  6. Restrict the plugin to the minimum Google Chat tools and permissions required; avoid broad or unrelated tool access.
  7. Run the plugin in a sandbox with limited filesystem, network, process, and credential access.
  8. Apply the same pinned and verified installation procedure to the troubleshooting path at SKILL.md:268-269.
  9. Monitor installed plugin versions and alert on unauthorized package or integrity changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.