ClawHub
Back to skill

Security audit

Google Contacts

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly sets up ClawLink so OpenClaw can read and edit Google Contacts, with confirmation required before writes.

Install this only if you trust ClawLink and the ClawHub plugin source. Connect only the intended Google account, review the OAuth scopes during pairing, and require clear confirmation before any contact, group, photo, or batch write/delete operation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:57
Finding

Unpinned Third-Party Plugin Installation and Authorization

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–62
Vulnerability Type: Unpinned executable dependency from a third-party package registry
Risk Level: Medium

Vulnerable Code

markdown
Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

```bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text

### Technical Analysis

The installation command references `clawhub:clawlink-plugin` without pinning an immutable version, package digest, or verified source revision. The instructions then add that plugin to the OpenClaw tool allowlist and restart the gateway, activating executable third-party functionality.

Although the document describes the plugin as “verified,” the audited project contains no checksum, signature-verification procedure, lock manifest, or bundled source code through which that assertion can be independently validated. Consequently, the implementation installed at setup time may differ from the implementation reviewed when this skill was published.

This creates a software supply-chain trust boundary. Compromise of the registry account, package distribution infrastructure, or a future mutable release could cause users following these instructions to install attacker-controlled code. The plugin also brokers OAuth-authenticated Google Contacts operations, making the dependency particularly sensitive.

### Attack Path

1. An attacker compromises the plugin publisher account, package registry, distribution channel, or another mechanism controlling the mutable `clawlink-plugin` package.
2. The attacker publishes a malicious package under the same unversioned package identifier.
3. A user or agent follows the skill instructions and runs `openclaw plugins install clawhub:clawlink-pl
...[truncated 1320 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, explicitly approved version rather than installing the latest package associated with a mutable name.
  2. Prefer a content-addressed package digest or cryptographically signed release and verify it before installation.
  3. Publish the expected checksum, signer identity, and exact verification commands in the setup procedure.
  4. Maintain a lock manifest recording the reviewed plugin version, source revision, and integrity digest.
  5. Provide a link to auditable source code corresponding exactly to the distributed package and use reproducible builds where possible.
  6. Restrict plugin and tool permissions to the minimum required Google Contacts operations. Do not grant access to unrelated integrations or system capabilities.
  7. Separate read and write permissions where supported, and require explicit user confirmation immediately before every write or destructive operation.
  8. Run the plugin in a sandbox with restricted filesystem, network, process, and credential access.
  9. Verify the installed package after installation and before adding it to the allowlist or restarting the gateway.
  10. Document a secure update process that requires integrity verification and review before activating a new plugin release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.