ClawHub
Back to skill

Security audit

Microsoft Excel

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Excel integration, but it should be reviewed because it installs and globally enables an unpinned third-party plugin that can access and modify Microsoft 365 spreadsheet data.

Review the ClawLink plugin and requested Microsoft OAuth scopes before installing. Use this only for Microsoft 365 accounts and workbooks you are comfortable exposing to the integration, require explicit confirmation for every write/share/delete action, and prefer a pinned or verified plugin version with a clear removal path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:53
Finding

Unpinned Third-Party Plugin Installation and Global Enablement

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–57
Vulnerability Type: Unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill directs the user or agent to install an external plugin without pinning it to an immutable version or integrity digest. It then adds that plugin to the global tool allowlist and restarts the OpenClaw gateway so that the newly installed component becomes active.

The plugin implementation is not included in the audited project, which contains only SKILL.md. Consequently, its source code, transitive dependencies, integrity, update behavior, and effective permissions cannot be verified from this artifact. The dependency retrieved at installation time could also differ from the component originally reviewed if the external package is updated, replaced, or compromised.

This is a supply-chain trust-boundary issue rather than evidence that the current plugin is malicious. The documented Excel functionality is consistent with the skill description, and no directly malicious payload was found in the reviewed file.

Attack Path

  1. An attacker compromises the external plugin package, its publisher account, or its distribution infrastructure.
  2. The user follows the skill instructions and runs the unversioned installation command.
  3. OpenClaw retrieves the compromised or modified plugin.
  4. The configuration command explicitly allows the plugin to expose and execute tools.
  5. The gateway restart loads the plugin into the OpenClaw environment.
  6. During later Excel operations, the plugin can process requests and OAuth-backed Microsoft 365 data according to its effective permissions.

Impact Assessment

A compromised dependency could execute with t ...[truncated 635 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing an unversioned package.
  2. Require cryptographic integrity verification using a trusted digest or signed release.
  3. Include or link to the exact auditable source corresponding to the pinned artifact.
  4. Document the plugin's requested OAuth scopes, local process privileges, network destinations, update policy, and data-retention behavior.
  5. Apply least privilege by allowing only the Excel tools required for the user's requested operation rather than broadly enabling the plugin.
  6. Obtain explicit user approval before each security-sensitive step: third-party installation, tool allowlisting, gateway restart, and Microsoft account authorization.
  7. Prefer a locally reviewable plugin or direct Microsoft Graph integration where practical.
  8. Add a rollback procedure that disables and removes the plugin if verification fails or unexpected behavior is observed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.