Mural

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Mural integration that discloses its OAuth flow, read access, and sticky-note write capability, with a supply-chain caution around the external plugin install.

Install only if you trust the ClawLink plugin source and are comfortable connecting your Mural account through OAuth. Review the Mural account permissions, confirm any sticky-note creation before execution, and consider pinning or verifying the plugin release where your OpenClaw deployment supports it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Plugin Installation and Enablement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-33
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation procedure retrieves clawlink-plugin without specifying an immutable version, digest, checksum, or signature. It then explicitly adds the plugin to the permitted tool list and restarts the gateway, causing the retrieved component to be loaded.

Because the plugin implementation is not included in the audited project, its behavior cannot be verified from this artifact. An unversioned dependency can also change after this review. If the package source, publisher account, distribution infrastructure, or latest package release is compromised, users following these instructions could install and enable behavior different from the version originally intended.

This finding concerns the dependency installation and trust model. The audited file does not itself contain an embedded malicious payload, and no compromise of the referenced plugin was established during this audit.

Attack Path

1. An attacker compromises the plugin publisher account or package-distribution channel, or otherwise causes the unversioned package identifier to resolve to a malicious release.
2. A user follows the documented command and installs the current package associated with clawhub:clawlink-plugin.
3. The user runs the configuration command, placing clawlink-plugin in tools.alsoAllow.
4. The gateway is restarted and loads the installed plugin.
5. The malicious or compromised plugin can act within the permissions granted to plugins and tools by the OpenClaw deployment.
6. If the user subsequently connects Mural, the compromised component may be able to interact with integration data or operations available throug ...[truncated 691 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than installing an implicitly mutable release.
2. Prefer an immutable content digest or package lock mechanism where supported.
3. Verify a publisher signature or a checksum obtained through an independent trusted channel before installation.
4. Document the authoritative package source and expected publisher identity.
5. Review the pinned plugin source and release artifacts before adding it to tools.alsoAllow.
6. Grant only the minimum tool and integration permissions required for the Mural workflow.
7. Run the plugin in a sandbox with restricted filesystem, process, network, and credential access.
8. Require explicit review before dependency upgrades, and monitor the package source for ownership or release changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

## Security & Permissions

- **Read** operations (browsing workspaces, rooms, murals, widgets, templates, tags) are safe and require no confirmation.
- **Write** operations (creating sticky notes) modify mural content and require explicit confirmation before execution.
- All operations respect the permissions of the authenticated Mural user.

Static analysis

No suspicious patterns detected.