ClawHub
Back to skill

Security audit

Jotform

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Jotform integration that uses ClawLink for account connection and requires confirmation for write actions, with the main caveat being reliance on an external plugin and hosted OAuth service.

Install this only if you trust ClawLink with access to the connected Jotform account. Review the plugin source/version and OAuth scopes where available, expect reads to expose submission data, and approve write actions only after the preview matches your intent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Plugin Is Allowlisted with Access to Jotform Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–52
Vulnerability Type: Unpinned and externally managed dependency
Risk Level: Medium

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation workflow retrieves clawlink-plugin from an external package channel without specifying an immutable version, commit, or integrity hash. It then explicitly adds the plugin to the tool allowlist and restarts the OpenClaw gateway, causing the retrieved component to be loaded into the agent environment.

The skill documentation states elsewhere that ClawLink mediates Jotform authentication, stores the OAuth token, injects it into API requests, and exposes tools capable of reading submissions and performing write operations. The plugin source and build artifacts are not included in the audited project, so its behavior and the implementation of its credential protections cannot be independently verified from this artifact. The assertion that the plugin is “verified” is also not substantiated by local integrity metadata.

This is a supply-chain risk rather than evidence that the current plugin is malicious. Because the dependency identifier is mutable and unpinned, a later compromised or unauthorized release could differ from the version originally reviewed while retaining the same installation command.

Attack Path

  1. An attacker compromises the dependency publisher, package registry entry, release pipeline, or another component of the external distribution channel.
  2. The attacker publishes a modified release under the mutable clawhub:clawlink-plugin identifier.
  3. A user follows the documented installation command and retrieves the compromised release without version or integrity verification.
  4. The documented configuration command allowlists the plugin, and the gateway restart loads it into the OpenCla ...[truncated 1287 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a reviewed, immutable version or content-addressed release rather than installing a mutable package identifier.
  2. Require cryptographic integrity verification, such as a trusted checksum or signature, before installation.
  3. Publish reproducible source and build provenance for the exact plugin release being installed.
  4. Document the precise Jotform OAuth scopes and reduce them to the minimum required for the selected operations.
  5. Separate read-only and write-capable authorization where the platform permits it.
  6. Require explicit user approval before plugin installation, allowlist modification, gateway restart, account connection, and each write operation.
  7. Restrict plugin network access to documented ClawLink and Jotform endpoints where runtime controls support egress allowlisting.
  8. Isolate OAuth credentials from general plugin execution and prevent plugins from reading or exporting raw tokens.
  9. Maintain an auditable release history and provide a procedure for revoking credentials and disabling compromised plugin versions.
  10. Periodically review the live tool catalog and remove tools or permissions that are not necessary for the user’s intended workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
## Resources

- [Jotform API Documentation](https://api.jotform.com/docs/)
- [Jotform Form Management](https://www.jotform.com/form-management/)
- ClawLink: https://claw-link.dev/?utm_source=clawhub&utm_medium=referral&utm_content=jotform-forms
- ClawLink Docs: https://docs.claw-link.dev/openclaw

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The tool reference says jotform_update_user_settings can update 'timezone, language, email', which introduces a language/locale-affecting capability in the natural-language description. Because the document does not pair this with any note that language changes should be user-directed or opt-in, it risks implying silent locale modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.