ClawHub
Back to skill

Security audit

Instantly

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Instantly integration, but it asks users to enable broad credential-bearing tools that include API-key administration and password-returning reads.

Install only if you trust ClawLink and are comfortable granting access to your Instantly workspace. Before use, verify the ClawLink plugin source/version, connect the least-privileged Instantly account available, avoid invoking API-key or password-returning tools unless explicitly needed, and revoke the OAuth connection or any created API keys when no longer required.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:42
Finding

Unpinned Privileged Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–49
Vulnerability Type: Unpinned third-party dependency with privileged tool access
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text
Then tell the user: "OpenClaw has been restarted. Send `/new` as a standalone message to start a fresh chat, then ask for Instantly again."

Technical Analysis

The Skill instructs the agent to install clawhub:clawlink-plugin without specifying an immutable version, package digest, or cryptographic integrity value. It subsequently adds the plugin to the tool allowlist and restarts the OpenClaw gateway, causing the installed component to be loaded into the agent environment.

Because the project contains only SKILL.md, the implementation of the installed plugin cannot be inspected as part of this audit. The assertion that the plugin is “verified” is not enforced by the provided commands. A mutable package reference can resolve to different code after the Skill itself has been reviewed.

The allowlisting and gateway restart increase the security relevance of this dependency: the plugin is not merely downloaded as passive content but enabled as a provider of credential-bearing tools. This creates a supply-chain trust boundary whose integrity is not pinned by the Skill.

Attack Path

  1. An attacker compromises the plugin publisher account, distribution infrastructure, or a future mutable release of clawhub:clawlink-plugin.
  2. The user authorizes installation according to the Skill instructions.
  3. openclaw plugins install clawhub:clawlink-plugin retrieves the current mutable package.
  4. The package is added to tools.alsoAllow.
  5. openclaw gateway restart loads the compromised package.
  6. In a new session, legitimate-looking ClawLink tool call ...[truncated 812 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing an unversioned package reference.
  2. Require verification of a cryptographic package signature and expected publisher identity before installation.
  3. Validate the package against a documented SHA-256 or equivalent integrity digest.
  4. Record the reviewed plugin version and digest directly in the Skill documentation.
  5. Require a new security review and explicit user approval whenever the pinned version changes.
  6. Avoid automatically allowlisting and restarting the gateway until package verification succeeds.
  7. Document the plugin's exact local and remote permissions before requesting installation.
  8. Restrict the plugin to the minimum tool and integration capabilities required for the requested operation.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:67
Finding

Over-Broad Credential-Bearing Integration Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–76 and 243–261
Vulnerability Type: Excessive integration privileges and sensitive credential access
Risk Level: High

Vulnerable Code

text
All Instantly tool calls are authenticated automatically by ClawLink using the user's connected Instantly account.

**No API key is required in chat.** ClawLink stores the OAuth token securely and injects it into every Instantly API request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=instantly and connect Instantly (requires an active Instantly account).
4. Call `clawlink_list_integrations` to verify the connection is active.

The exposed administrative and sensitive-data tools include:

text
| `instantly_api_keys_get` | List all API keys with names, scopes, and timestamps | Read |
| `instantly_create_api_key` | Create a new API key with specified permissions | Write |
| `instantly_delete_api_key` | Delete a specific API key by ID | Write |
text
| `instantly_get_dfy_email_account_order_accounts` | Get accounts from DFY orders with optional passwords | Read |

Technical Analysis

Authentication is delegated to the hosted ClawLink intermediary, which stores the user's OAuth token and injects it into proxied Instantly API requests. The Skill exposes capabilities that extend beyond routine campaign management, including API-key administration and retrieval of DFY account information with optional passwords.

The document states that write operations require user confirmation, but it does not establish least-privilege OAuth scopes, per-capability authorization, or equivalent approval requirements for sensitive read operations. In particular, password retrieval is categorized as a read operation even though ...[truncated 1829 chars]

Remediation
View remediation

Remediation Suggestions

  1. Request only the minimum OAuth scopes needed for the user's current task.
  2. Disable API-key administration and password-returning tools by default.
  3. Place credential retrieval and API-key creation behind separate, explicit capability grants.
  4. Require fresh user confirmation for sensitive reads, including any operation capable of returning passwords, tokens, secrets, or full email content.
  5. Display the exact requested OAuth scopes and affected workspace before account connection.
  6. Apply server-side authorization independently of agent-provided confirmation parameters.
  7. Redact passwords, tokens, and API-key material from tool output, logs, previews, and conversational history.
  8. Use short-lived tokens where supported and provide documented token revocation, rotation, and disconnection procedures.
  9. Maintain immutable audit logs for sensitive reads, credential creation, webhook changes, and destructive operations.
  10. Separate ordinary campaign-management permissions from workspace-administration permissions through distinct roles or connections.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes administrative API-key creation and deletion capabilities inside a skill whose stated purpose is campaign operations. API keys provide durable, reusable access beyond the immediate chat session, so a compromised or overly broad workflow could mint long-lived credentials that enable persistent access, privilege extension, or off-platform abuse. In this context, the skill’s broad operational scope makes the presence of key-management functions more dangerous because they are not necessary for ordinary campaign tasks and expand the blast radius from campaign actions to workspace administration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.