ClawHub
Back to skill

Security audit

Google Photos

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Photos integration that relies on ClawLink for OAuth and tool calls, with no artifact evidence of hidden or malicious behavior.

Install only if you are comfortable trusting ClawLink and the ClawHub plugin source with Google Photos OAuth access. Review the Google account permissions during connection, confirm write actions carefully, and revoke the Google/ClawLink connection or remove the plugin if you no longer need it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Plugin Installation and Authorization

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–52
Vulnerability Type: Unpinned third-party dependency with tool authorization
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references the mutable package identifier clawhub:clawlink-plugin without specifying an immutable version, cryptographic digest, or verifiable signature. The subsequent command adds that plugin to the OpenClaw tool allowlist, and the gateway restart activates it.

The plugin implementation is not included in the audited project, so its behavior cannot be verified from the available source. Although the document calls the plugin “verified,” it provides no local integrity metadata that binds installation to the reviewed release. Consequently, a compromised registry account, package repository, distribution channel, or future package version could cause users to install code different from the code originally assessed.

This is a supply-chain weakness rather than evidence that the current plugin is malicious.

Attack Path

  1. An attacker compromises the plugin publisher, registry entry, release process, or another part of the package distribution channel.
  2. The attacker publishes a malicious release under the unchanged clawhub:clawlink-plugin identifier.
  3. A user follows the Skill instructions and installs the mutable package reference.
  4. The user adds the plugin to tools.alsoAllow, expanding the set of authorized OpenClaw tools.
  5. The gateway restart loads and activates the installed plugin.
  6. The malicious plugin executes within the privileges available to OpenClaw plugins and may intercept tool inputs, manipulate results, or misuse accessible integration data.

Impact Assessment

Successful exploitation cou ...[truncated 778 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specific, audited, immutable version rather than installing the latest release through a mutable identifier.
  2. Publish a cryptographic digest or signed provenance record for the approved artifact and verify it before installation.
  3. Document the expected publisher identity, package source, permissions, and verified checksum.
  4. Separate installation from authorization. Require users or administrators to review the plugin and its requested capabilities before adding it to tools.alsoAllow.
  5. Apply least privilege to the plugin runtime, including restricted filesystem, network, process, and integration access.
  6. Provide procedures to revoke authorization, uninstall the plugin, disconnect OAuth access, and roll back to a known-good version.
  7. Monitor releases and alert users if the verified artifact digest or signing identity changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.