ClawHub
Back to skill

Security audit

npm Registry

Security checks for vulnerabilities and agentic risk

Overview

The skill is not shown to be harmful, but it asks to install and allow a third-party ClawLink plugin that can use an npm account, including private package data.

Install only if you trust ClawLink and are comfortable connecting an npm account. Prefer a least-privilege npm account or token, review the permissions in the ClawLink dashboard, and be especially careful before approving write operations such as token deletion or scope changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unaudited Third-Party Plugin Is Granted Authenticated npm Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-49, 69-77, 108
Vulnerability Type: Third-party supply-chain exposure and excessive integration privileges
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text
All npm tool calls are authenticated automatically by ClawLink using the user's npm account.

No API key is required in chat. ClawLink handles authentication securely and injects it into every npm API request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=npm and connect npm.
4. Call `clawlink_list_integrations` to verify the connection is active.
text
- Access is scoped to public and private package data within the connected npm account.

Technical Analysis

The Skill directs the Agent to install and explicitly allowlist clawlink-plugin, restart the OpenClaw gateway, and connect the user's npm account through an external service. The plugin implementation is not included in the audited project, so its executable behavior, dependency versions, integrity, update policy, credential handling, and effective permissions cannot be verified from this artifact.

The integration is also documented as having access to private package data. This exceeds the permissions needed for many advertised operations, such as searching public packages, retrieving public metadata, and reading public download statistics. Although account pairing is described and no malicious behavior is directly demonstrated, the design creates a supply-chain trust boundary with access to sensitive npm resources.

Attack Path

  1. A user installs this Skill and follows its setup instructi ...[truncated 1485 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specific, reviewed version rather than installing an unversioned package.
  2. Verify the downloaded plugin using a cryptographic digest or signed provenance before loading it.
  3. Include or reference auditable plugin source code and document its dependency tree, update behavior, network destinations, and credential-handling model.
  4. Use unauthenticated npm Registry APIs for public searches, metadata, advisories, and download statistics whenever possible.
  5. Request npm authentication only when a user explicitly asks to access private resources.
  6. Use a dedicated, read-only, least-privilege npm credential restricted to the required organization, scope, and operations.
  7. Require informed confirmation before plugin installation, allowlisting, gateway restart, account pairing, or expansion of npm permissions.
  8. Avoid broad or global plugin allowlisting. Restrict the plugin to the specific Agent and workflow that require it.
  9. Pin and validate the live tool catalog rather than treating remotely supplied tools as inherently trusted. Enforce a local allowlist of approved read operations.
  10. Log authenticated operations and provide straightforward credential revocation, session expiration, and integration-disconnection procedures.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.