ClawHub
Back to skill

Security audit

Kibana

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for Kibana administration, but it asks users to enable an unpinned third-party plugin that will handle Kibana credentials and high-impact operations.

Install only if you trust the ClawLink plugin publisher and are comfortable granting it access to your Kibana instance. Prefer a dedicated Kibana identity with the least privileges needed, verify the plugin source/version if possible, and review every preview carefully before approving delete or Fleet/security changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Third-Party Plugin Is Granted Access to a Sensitive Kibana Integration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–46
Vulnerability Type: Unpinned third-party dependency with privileged integration access
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references the mutable package identifier clawhub:clawlink-plugin without specifying an immutable version, digest, checksum, or verifiable signature. The subsequent command explicitly adds that plugin to the allowed tool configuration, after which the OpenClaw gateway is restarted to activate it.

Elsewhere, SKILL.md states that ClawLink stores authentication tokens and injects them into requests to a connected Kibana instance. The documented integration also exposes access to operational and security data and supports destructive actions such as deleting alerting rules, connectors, saved objects, Fleet outputs, Fleet proxies, lists, and Osquery saved queries.

Because the plugin's implementation is not included in the audited project and the installation is not pinned to an immutable artifact, this project cannot establish that the installed code corresponds to a reviewed release. A registry compromise, publisher-account compromise, or malicious future update could therefore alter the code executing within this trusted integration path.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry entry, or mutable release associated with clawhub:clawlink-plugin.
  2. The attacker publishes a modified plugin under the same package identifier.
  3. A user follows the instructions in SKILL.md and installs the package without a version or digest constraint.
  4. The user explicitly grants the plugin tool access through tools.alsoAllow.
  5. The gateway restart loads and activates the compromised plugin.
  6. The plugin can then ...[truncated 852 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an audited, immutable version or content digest rather than installing a mutable package identifier.
  2. Verify the artifact using a cryptographic checksum and a trusted publisher signature before enabling it.
  3. Publish or vendor the exact corresponding plugin source so its behavior can be independently reviewed.
  4. Configure the plugin with only the minimum tools and permissions required for the intended Kibana tasks.
  5. Use a dedicated Kibana service identity with narrowly scoped roles instead of a broadly privileged account.
  6. Disable destructive Kibana capabilities by default and preserve explicit, operation-specific confirmation for every write.
  7. Maintain an allowlist of trusted package versions and require security review before upgrades.
  8. Monitor plugin installation, updates, authentication use, and destructive Kibana operations through auditable logs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.