Instantly

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.5

Overview

The skill is mostly a disclosed Instantly integration, but it asks users to enable broad credential-bearing tools that include API-key administration and password-returning reads.

Install only if you trust ClawLink and are comfortable granting access to your Instantly workspace. Before use, verify the ClawLink plugin source/version, connect the least-privileged Instantly account available, avoid invoking API-key or password-returning tools unless explicitly needed, and revoke the OAuth connection or any created API keys when no longer required.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42
• Finding: Unpinned Privileged Third-Party Plugin Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 42–49 **Vulnerability Type**: Unpinned third-party dependency with privileged tool access **Risk Level**: High ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ```text Then tell the user: "OpenClaw has been restarted. Send `/new` as a standalone message to start a fresh chat, then ask for Instantly again." ``` ### Technical Analysis The Skill instructs the agent to install `clawhub:clawlink-plugin` without specifying an immutable version, package digest, or cryptographic integrity value. It subsequently adds the plugin to the tool allowlist and restarts the OpenClaw gateway, causing the installed component to be loaded into the agent environment. Because the project contains only `SKILL.md`, the implementation of the installed plugin cannot be inspected as part of this audit. The assertion that the plugin is “verified” is not enforced by the provided commands. A mutable package reference can resolve to different code after the Skill itself has been reviewed. The allowlisting and gateway restart increase the security relevance of this dependency: the plugin is not merely downloaded as passive content but enabled as a provider of credential-bearing tools. This creates a supply-chain trust boundary whose integrity is not pinned by the Skill. ### Attack Path 1. An attacker compromises the plugin publisher account, distribution infrastructure, or a future mutable release of `clawhub:clawlink-plugin`. 2. The user authorizes installation according to the Skill instructions. 3. `openclaw plugins install clawhub:clawlink-plugin` retrieves the current mutable package. 4. The package is added to `tools.alsoAllow`. 5. `openclaw gateway restart` loads the compromised package. 6. In a new session, legitimate-looking ClawLink tool call ...[truncated 812 chars]
• Remediation: ## Remediation Suggestions 1. Pin the plugin to an immutable, reviewed version rather than installing an unversioned package reference. 2. Require verification of a cryptographic package signature and expected publisher identity before installation. 3. Validate the package against a documented SHA-256 or equivalent integrity digest. 4. Record the reviewed plugin version and digest directly in the Skill documentation. 5. Require a new security review and explicit user approval whenever the pinned version changes. 6. Avoid automatically allowlisting and restarting the gateway until package verification succeeds. 7. Document the plugin's exact local and remote permissions before requesting installation. 8. Restrict the plugin to the minimum tool and integration capabilities required for the requested operation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:67
• Finding: Over-Broad Credential-Bearing Integration Access## Vulnerability Details **File Location**: `SKILL.md`, lines 67–76 and 243–261 **Vulnerability Type**: Excessive integration privileges and sensitive credential access **Risk Level**: High ### Vulnerable Code ```text All Instantly tool calls are authenticated automatically by ClawLink using the user's connected Instantly account. **No API key is required in chat.** ClawLink stores the OAuth token securely and injects it into every Instantly API request on the user's behalf. ### Getting Connected 1. Install the ClawLink plugin (see Install above). 2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet. 3. Open https://claw-link.dev/dashboard?add=instantly and connect Instantly (requires an active Instantly account). 4. Call `clawlink_list_integrations` to verify the connection is active. ``` The exposed administrative and sensitive-data tools include: ```text | `instantly_api_keys_get` | List all API keys with names, scopes, and timestamps | Read | | `instantly_create_api_key` | Create a new API key with specified permissions | Write | | `instantly_delete_api_key` | Delete a specific API key by ID | Write | ``` ```text | `instantly_get_dfy_email_account_order_accounts` | Get accounts from DFY orders with optional passwords | Read | ``` ### Technical Analysis Authentication is delegated to the hosted ClawLink intermediary, which stores the user's OAuth token and injects it into proxied Instantly API requests. The Skill exposes capabilities that extend beyond routine campaign management, including API-key administration and retrieval of DFY account information with optional passwords. The document states that write operations require user confirmation, but it does not establish least-privilege OAuth scopes, per-capability authorization, or equivalent approval requirements for sensitive read operations. In particular, password retrieval is categorized as a read operation even though ...[truncated 1829 chars]
• Remediation: ## Remediation Suggestions 1. Request only the minimum OAuth scopes needed for the user's current task. 2. Disable API-key administration and password-returning tools by default. 3. Place credential retrieval and API-key creation behind separate, explicit capability grants. 4. Require fresh user confirmation for sensitive reads, including any operation capable of returning passwords, tokens, secrets, or full email content. 5. Display the exact requested OAuth scopes and affected workspace before account connection. 6. Apply server-side authorization independently of agent-provided confirmation parameters. 7. Redact passwords, tokens, and API-key material from tool output, logs, previews, and conversational history. 8. Use short-lived tokens where supported and provide documented token revocation, rotation, and disconnection procedures. 9. Maintain immutable audit logs for sensitive reads, credential creation, webhook changes, and destructive operations. 10. Separate ordinary campaign-management permissions from workspace-administration permissions through distinct roles or connections.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill exposes administrative API-key creation and deletion capabilities inside a skill whose stated purpose is campaign operations. API keys provide durable, reusable access beyond the immediate chat session, so a compromised or overly broad workflow could mint long-lived credentials that enable persistent access, privilege extension, or off-platform abuse. In this context, the skill’s broad operational scope makes the presence of key-management functions more dangerous because they are not necessary for ordinary campaign tasks and expand the blast radius from campaign actions to workspace administration.

Static analysis

No suspicious patterns detected.