ClawHub
Back to skill

Security audit

Grafana

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Grafana integration that installs and uses ClawLink for authenticated Grafana API access, with write actions requiring user confirmation.

Before installing, confirm you trust the ClawLink plugin source and connect Grafana with a least-privilege API key or service account. Review write previews carefully because the enabled tools can modify or delete Grafana resources within the connected credential's permissions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–56
Vulnerability Type: Unpinned and insufficiently verified third-party dependency
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation procedure retrieves clawlink-plugin through a mutable package identifier without pinning an audited version, specifying an immutable artifact digest, or requiring cryptographic signature or checksum verification. It then explicitly adds that plugin to the OpenClaw tool allowlist and restarts the gateway, which activates the installed component.

Although the document describes the plugin as “verified,” the provided procedure contains no locally enforceable integrity check. Consequently, the code installed at different times under the same package identifier may differ from the component that was originally reviewed. This creates a supply-chain trust gap involving the package registry, publisher account, distribution infrastructure, and future releases.

Exploitation requires an attacker to compromise one of those supply-chain elements or otherwise gain the ability to distribute a malicious artifact under the expected identifier. The reviewed file does not itself demonstrate that the current plugin is malicious.

Attack Path

  1. An attacker compromises the plugin publisher account, registry entry, release process, or artifact distribution infrastructure.
  2. The attacker publishes a modified package under the mutable clawhub:clawlink-plugin identifier.
  3. A user follows the documented installation command, which downloads the attacker-controlled release because no immutable version or digest is specified.
  4. The configuration command explicitly allowlists the installed plugin.
  5. The gateway restart loads and activates the compromised component.
  6. The malicious plu ...[truncated 905 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specific, audited version rather than installing through an unversioned package identifier.
  2. Prefer an immutable artifact reference, such as a content digest or commit identifier, where the package system supports it.
  3. Require cryptographic signature verification or compare the downloaded artifact against a publisher-provided checksum before allowlisting it.
  4. Document the expected publisher identity, version, artifact digest, signature authority, and verification procedure.
  5. Separate installation from activation: do not add the plugin to tools.alsoAllow until its identity and integrity have been verified.
  6. Review release notes and security changes before upgrading; avoid unattended updates to mutable latest releases.
  7. Apply least privilege to the plugin runtime and Grafana service account. Grant only the specific read or write capabilities required for the user's intended workflows.
  8. Restrict network access and credential exposure where OpenClaw's plugin sandboxing or policy controls permit it.
  9. Maintain an approved-version rollback procedure and audit logs for plugin installation, activation, and Grafana operations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.