LinkHut

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.0.1

Overview

This LinkHut skill is purpose-aligned, but it asks users to install and permanently enable an unaudited external plugin that is not pinned to a specific version.

Review the ClawLink plugin package and publisher before installing. Only proceed if you trust the plugin to handle your LinkHut account access and bookmark data, and consider asking for a pinned version, permission details, and a rollback path before enabling it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Plugin Installation and Activation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–33
Vulnerability Type: Unpinned and unauditable third-party dependency
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill instructs users to install a remotely sourced plugin without specifying an immutable version, checksum, signature, or source commit. It then explicitly adds that plugin to the allowed tool configuration and restarts the OpenClaw gateway to activate it.

Because this project contains only SKILL.md and does not include the plugin implementation, the installed behavior, requested permissions, OAuth handling, and data-processing logic cannot be verified by auditing this package. The effective implementation may also change after review if the mutable package reference resolves to a later release.

This creates a supply-chain trust boundary: the safety of the skill depends on the integrity of the package registry, publisher account, distribution process, and all transitive components of clawlink-plugin.

Attack Path

1. An attacker compromises the plugin publisher account, package registry entry, release pipeline, or an upstream dependency.
2. The attacker publishes a malicious release under the existing mutable clawlink-plugin package identifier.
3. A user follows line 31 and installs the compromised release because no version or integrity value is pinned.
4. Line 32 adds the plugin to the allowed tool set.
5. Line 33 restarts the gateway, activating the compromised implementation.
6. Subsequent legitimate-looking ClawLink operations execute attacker-controlled plugin logic.

Impact Assessment

A compromised plugin could execute with the permissions granted to the OpenClaw plugin context. Depending on runtime isolation and available interfaces, it could manipulate tool behavior or ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an immutable, independently audited version rather than using a mutable package identifier.
2. Verify a publisher signature and cryptographic package checksum before installation.
3. Publish the plugin source and tie each distributed package to a verifiable source commit and reproducible build.
4. Document the plugin's exact runtime permissions, network destinations, credential access, and data-retention behavior.
5. Apply least privilege so the plugin can access only the LinkHut operations and data required for its stated functionality.
6. Require explicit user approval before installation, allow-list modification, and gateway activation.
7. Audit and pin transitive dependencies, and use automated dependency integrity and provenance checks.
8. Provide a rollback procedure and revoke affected OAuth sessions if package integrity is later questioned.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

## Security & Permissions

- **Read** tools are safe and require no confirmation
- **Write** tools require confirmation before execution
- Bookmark deletion is high-impact and irreversible

Static analysis

No suspicious patterns detected.