ClawHub
Back to skill

Security audit

Hostinger

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Hostinger-management purpose, but it asks users to install and allowlist an unpinned third-party credential-broker plugin with authority over high-impact hosting resources.

Review the ClawLink plugin publisher, version, and permissions before installing. Only connect Hostinger accounts whose domains, DNS, VPS, and billing data you are comfortable exposing to this integration, and confirm every write action carefully.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Third-Party Plugin Is Installed and Granted Tool Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-48
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The documented setup installs clawlink-plugin from a mutable package identifier without specifying a version, immutable digest, checksum, or signature-verification procedure. It then explicitly adds the plugin to the tool allowlist and restarts the gateway, activating code that is not included in the audited project.

The project calls the plugin “verified,” but the installation workflow provides no locally verifiable integrity evidence. Consequently, the effective plugin code may change independently after this Skill has been reviewed. This creates a supply-chain trust boundary: compromise of the package publisher, registry, distribution channel, or a future plugin release could cause users to install code different from the version originally assessed.

This audit does not establish that the external plugin is malicious. The vulnerability is the unsafe, unpinned installation and activation process combined with the plugin's privileged role in brokering Hostinger credentials and API operations.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry, release pipeline, or another component serving the mutable clawlink-plugin package.
  2. The attacker publishes a modified package under the same unversioned package identifier.
  3. A user follows the instructions and runs openclaw plugins install clawhub:clawlink-plugin.
  4. OpenClaw resolves and installs the attacker-controlled package because no trusted version, digest, or checksum is specified.
  5. The next command adds the installed plugin to tools.alsoAllow.
  6. Restarting the gateway loads and a ...[truncated 1084 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specifically reviewed version rather than installing a mutable latest release.
  2. Prefer an immutable package digest or content hash when supported.
  3. Publish an expected cryptographic checksum or signature and verify it before installation.
  4. Document the authoritative publisher identity, package repository, release provenance, and verification procedure.
  5. Separate installation from allowlisting: require the user or administrator to verify package integrity and review requested permissions before enabling the plugin.
  6. Apply least privilege to the plugin, limiting filesystem, network, credential, tool, and Hostinger API access to capabilities strictly required for the requested operation.
  7. Enforce write confirmation in a trusted layer outside the third-party plugin so a compromised plugin cannot bypass approval requirements.
  8. Provide rollback, uninstall, credential-revocation, and account-disconnection instructions for incident response.
  9. Audit the exact pinned plugin source and its transitive dependencies before representing it as verified.
  10. Establish a controlled update process that requires integrity verification and security review before moving to a newer plugin release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.