ClawHub
Back to skill

Security audit

Google Classroom

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Google Classroom integration, but it requires trusting the external ClawLink plugin and OAuth broker.

Install only if you trust ClawLink and the ClawHub plugin package. Use the least-privileged Google account that fits your task, and review previews carefully before approving grade, roster, coursework, course deletion, or announcement changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Is Installed and Granted Trusted Tool Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49
Vulnerability Type: Unpinned and externally maintained executable dependency
Risk Level: Medium

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill directs the agent to install the externally maintained clawlink-plugin, add it to OpenClaw's trusted tool allowlist, and restart the gateway so the plugin is loaded. The dependency is identified only by a mutable registry name. No exact version, cryptographic digest, signature-verification procedure, or immutable source reference is provided.

The plugin's executable implementation is not included in the audited project, which contains only SKILL.md. Its dependency integrity and runtime behavior therefore cannot be verified from this artifact. Referring to the plugin as “verified” does not provide an auditable integrity guarantee.

The risk extends to sensitive educational information because the document states that ClawLink stores the user's Google OAuth token and injects it into proxied Google Classroom requests. Although this credential-broker behavior is disclosed and consistent with the skill's stated purpose, compromise or substitution of the plugin could expose the connected account and Classroom data.

Attack Path

  1. An attacker compromises the external plugin publisher, registry entry, distribution infrastructure, or an unpinned future plugin release.
  2. The skill runs openclaw plugins install clawhub:clawlink-plugin, resolving and installing the attacker-controlled or compromised artifact.
  3. The configuration command explicitly places the plugin in tools.alsoAllow, granting it trusted tool access.
  4. The gateway restart loads the installed plugin into OpenClaw.
  5. The user pairs the plugin and connects a Google account through the documented OAuth flow.
  6. The compromised plugi ...[truncated 920 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specifically reviewed version and cryptographic digest rather than resolving a mutable registry name.
  2. Require package-signature and digest verification before installation, and fail closed if verification is unavailable or unsuccessful.
  3. Provide an immutable source reference and reproducible-build information so reviewers can correlate the installed artifact with audited source code.
  4. Document the exact Google OAuth scopes, plugin permissions, token retention policy, encryption controls, revocation process, and third-party data handling.
  5. Restrict the plugin to the minimum tool and OAuth permissions required for the requested operation. Separate read-only access from roster, grading, publishing, and deletion capabilities where possible.
  6. Require explicit informed user confirmation before plugin installation, allowlist modification, gateway restart, account pairing, and each sensitive write operation.
  7. Perform dependency security review and continuous monitoring for publisher changes, compromised releases, revoked signatures, and unexpected updates.
  8. Run the plugin in a constrained sandbox with limited filesystem, process, network, and credential access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.