ClawHub
Back to skill

Security audit

Google Maps

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Google Maps integration, but it asks users to install and persistently allowlist an unpinned third-party plugin while under-emphasizing sensitive location privacy risks.

Install only if you trust the ClawLink plugin publisher and are comfortable with persistent OpenClaw plugin allowlisting. Before using it, verify the plugin source or version if possible, connect only the intended Google Maps credential, and require explicit user approval before any precise address, route, nearby-search, or cell/WiFi geolocation request.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:54
Finding

Unpinned Third-Party Plugin Installation and Global Allowlisting

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–58
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation instructions retrieve clawlink-plugin from a third-party package registry without specifying an immutable version, cryptographic digest, or signature requirement. They then add the plugin to OpenClaw's allowed tools and restart the gateway so that the downloaded component is loaded.

Because the project contains only SKILL.md and does not include the plugin's source code, lock data, checksum, or signature, the executable behavior of the installed dependency cannot be verified from the audited artifact. The mutable package reference also means the component installed in the future may differ from the component originally reviewed by the Skill author.

This creates a supply-chain trust boundary: compromise of the registry entry, publisher account, distribution infrastructure, or a future plugin release could cause users following these instructions to load attacker-controlled plugin code.

Attack Path

  1. An attacker compromises the plugin publisher account, registry entry, release process, or distribution infrastructure.
  2. The attacker publishes a malicious release under the mutable clawlink-plugin package reference.
  3. A user follows the Skill's documented installation command, which retrieves the current package without checking a pinned version or digest.
  4. The user follows the configuration command, adding the plugin to the allowed tool set.
  5. The gateway restart loads the compromised plugin.
  6. The plugin can then execute within the privileges and context granted to OpenClaw plugins and intercept or manipulate operations routed through it.

...[truncated 698 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specifically reviewed version rather than using a mutable package reference.
  2. Require verification against an immutable cryptographic digest or a trusted publisher signature before installation.
  3. Publish or reference the exact plugin source and reproducible build information corresponding to the pinned release.
  4. Use a trusted lockfile or equivalent dependency manifest to prevent silent version changes.
  5. Replace broad plugin allowlisting with the narrowest available set of named Google Maps capabilities.
  6. Run the plugin in a sandbox with restricted filesystem, network, process, and credential access.
  7. Require explicit user approval before installation, allowlist modification, and gateway restart.
  8. Document a verification procedure for the package publisher, version, signature, and checksum.
  9. Periodically review and revoke unused plugin permissions and integration credentials.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The authentication section emphasizes automatic use of the user's connected account or API key but does not provide a corresponding privacy warning about location-sensitive queries and account-backed data access. This can normalize silent access to sensitive mapping/location operations without reminding users or agents to obtain informed consent for potentially revealing addresses, travel patterns, or nearby searches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that access is scoped to location and routing data, but the documented toolset also includes device geolocation from cell towers and WiFi nodes. That mismatch can mislead users and downstream agents about the sensitivity of accessible data, increasing the chance of collecting or disclosing precise location information without appropriate caution or consent framing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The permission/scoping language understates the breadth of the toolset by framing it as location and routing access while also exposing a geolocation feature. In security-sensitive environments, inaccurate scoping documentation can cause operators or users to authorize a skill under false assumptions about what data it can process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Listing a device geolocation capability without a prominent warning about sensitive location handling is risky because it may encourage use of a highly privacy-sensitive function as if it were routine read-only lookup. Even if technically read-only, inferred device location can expose home/work locations or live whereabouts, making misuse materially harmful.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.