ClawHub
Back to skill

Security audit

New Relic

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent New Relic integration, but it enables broad administrative access through a persistent third-party ClawLink plugin and hosted New Relic credential custody.

Install only if you trust ClawLink with your New Relic account access. Prefer a dedicated least-privilege New Relic credential, start with read-only permissions where possible, and require explicit review before any user, API-key, account, alert, dashboard, monitor, cloud-integration, or deletion action.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:39
Finding

Unpinned Third-Party Plugin Installation and Activation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-47
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Install

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

```bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text

### Technical Analysis

The Skill instructs users to install a third-party plugin using the mutable package identifier `clawhub:clawlink-plugin`. It does not pin an audited version, specify an immutable package digest, or require a signature or integrity verification step.

The subsequent configuration command globally allows the plugin, and restarting the gateway activates the installed package. Because the plugin implementation is not included in this project, its effective behavior cannot be reviewed as part of this audit. A future release, compromised publisher account, or compromised package-distribution channel could therefore change the code executed by users without requiring a corresponding change to `SKILL.md`.

This is an unsafe supply-chain pattern rather than evidence that the current package is malicious.

### Attack Path

1. An attacker compromises the plugin publisher account, package registry, or release pipeline.
2. The attacker publishes a modified release under the existing `clawhub:clawlink-plugin` identifier.
3. A user follows the Skill's installation instructions.
4. OpenClaw resolves the mutable identifier to the attacker-controlled release.
5. The configuration command adds the plugin to the globally allowed tools.
6. The gateway restart loads and activates the modified plugin.
7. The plugin can then act within the permissions available to the OpenClaw plugin environment and con
...[truncated 563 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specific audited version rather than using only a mutable package name.
  2. Require verification against an immutable cryptographic digest before installation.
  3. Document and enforce publisher-signature verification.
  4. Avoid automatically enabling the plugin or restarting the gateway until integrity checks succeed.
  5. Scope plugin authorization to the minimum tools and integrations required for the current task.
  6. Maintain a reviewed allowlist of approved plugin versions and block automatic upgrades.
  7. Publish the plugin source or provide reproducible build and provenance information so its behavior can be independently audited.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:66
Finding

Broad Third-Party Credential Custody and Excessive New Relic Capabilities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-70 and 365-396
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Authentication

All New Relic tool calls are authenticated automatically by ClawLink using the user's connected New Relic account.

**No API key is required in chat.** ClawLink stores the API key securely and injects it into every New Relic NerdGraph request on the user's behalf.
markdown
### Users & Access

| Tool | Description | Mode |
|------|-------------|------|
| `new_relic_create_user` | Create a new user in an authentication domain (requires domain ID, email, name, user type tier) | Write |
| `new_relic_update_user` | Update a user's email or access tier (requires user ID and at least one field) | Write |
| `new_relic_delete_user_management_user` | Delete a user from the New Relic account | Write |
| `new_relic_revoke_authorization_access` | Revoke specific role assignments from a group for one or more accounts | Write |
| `new_relic_update_cross_account_elections` | Enable or disable cross-account alerting for specific accounts | Write |

### API Access Keys

| Tool | Description | Mode |
|------|-------------|------|
| `new_relic_create_api_access_keys` | Create user API keys or ingest keys (BROWSER or LICENSE types — max 1,000 per type per account) | Write |
| `new_relic_update_api_access_keys` | Update an API key's name or notes (requires key ID, not the actual key value) | Write |
| `new_relic_delete_api_access_keys` | Permanently delete API keys (deleted keys no longer grant access) | Write |

### Account Management

| Tool | Description | Mode |
|------|-------------|------|
| `new_relic_update_account` | Update a New Relic account name via NerdGraph | Write |
| `new_relic_fetch_your_org_id` | Get the organization ID and name for the authenticated user | Rea
...[truncated 3109 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a dedicated New Relic credential created specifically for this Skill.
  2. Default to read-only New Relic permissions for telemetry, entity, alert, and dashboard inspection.
  3. Disable user management, API-key management, authorization revocation, account management, and cross-account tools unless explicitly enabled by an administrator.
  4. Separate read-only and administrative connections so routine monitoring never uses an administrative credential.
  5. Enforce authorization and confirmation on the ClawLink server, not only through Agent instructions.
  6. Use short-lived or delegated credentials where New Relic supports them.
  7. Encrypt stored credentials with tenant-separated keys and restrict decryption to the minimum proxy component.
  8. Add operation-level audit logs showing the caller, target account, tool, parameters, authorization decision, and result.
  9. Redact tokens and sensitive credential material from tool responses, logs, previews, and chat history.
  10. Require step-up authentication and explicit administrator approval for user, key, role, account, and cross-account operations.
  11. Document immediate revocation procedures for both ClawLink access and the underlying New Relic credential.
  12. Restrict new_relic_fetch_mobile_application_token to explicit user requests and prevent its result from being sent to destinations not approved by the user.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description grants very broad operational scope across New Relic, including many write-capable and destructive actions, but it does not define clear trigger boundaries, allowed contexts, or activation constraints. In an agent setting, overly broad invocation criteria can cause the skill to be selected for ambiguous user requests and increase the chance of unintended high-impact actions against monitoring, alerting, dashboards, credentials, users, or cloud integrations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown body advertises an extensive set of capabilities without sufficiently constraining when the agent should or should not activate them, despite the presence of many sensitive write operations. This broad framing makes accidental or over-eager tool use more likely, especially where natural-language requests could be interpreted as approval to modify alerts, users, dashboards, synthetic monitors, credentials, or cloud integrations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.