ClawHub
Back to skill

Security audit

OneDrive Files

Security checks for vulnerabilities and agentic risk

Overview

This OneDrive skill is a disclosed ClawLink integration with broad cloud-file access, but its sensitive actions are purpose-aligned and require user confirmation for writes.

Install only if you are comfortable connecting your Microsoft account through ClawLink. Review the Microsoft consent screen, use the least-privileged account suitable for the task, and require explicit confirmation before uploads, deletions, permission changes, or sharing-link creation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned External Plugin Receives Broad Access to Cloud Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-84
Vulnerability Type: Unpinned third-party dependency with access to Microsoft OAuth credentials and OneDrive data
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
markdown
All OneDrive tool calls are authenticated automatically by ClawLink using the user's connected Microsoft account.

**No API key is required in chat.** ClawLink stores the OAuth token securely and injects it into every Microsoft Graph request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=onedrive and connect OneDrive.
4. Call `clawlink_list_integrations` to verify the connection is active.

Technical Analysis

The skill instructs the agent to install and allowlist clawlink-plugin without specifying an immutable version, package digest, signature, or integrity check. The plugin implementation is not included in the audited project, so its executable behavior, update process, token handling, and enforcement of request boundaries cannot be verified from the available source.

After installation, the gateway is restarted and the plugin is authorized as an available tool provider. The documentation also states that ClawLink stores the user's OAuth token and injects it into Microsoft Graph requests. Consequently, the external plugin and hosted service occupy a security-sensitive position with access to authenticated OneDrive and SharePoint operations.

This is a supply-chain risk rather than evidence that the current plugin is malicious. However, installing an unpinned component permits its effective implementation to change after this skill has been r ...[truncated 1469 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawlink-plugin to a reviewed, immutable version and preferably a cryptographic package digest.
  2. Verify a publisher signature and checksum before installation, and fail closed if verification fails.
  3. Publish or vendor the relevant plugin source so its token handling, network destinations, update behavior, and request authorization can be audited.
  4. Document the exact Microsoft OAuth scopes requested and remove permissions not required for the intended OneDrive operations.
  5. Separate read-only and write-capable authorization where Microsoft Graph permits it, using read-only access by default.
  6. Prefer per-skill or per-session authorization over global plugin allowlisting.
  7. Require explicit, transaction-bound confirmation for uploads, modifications, deletions, permission changes, and sharing operations.
  8. Restrict outbound communication to documented ClawLink and Microsoft Graph endpoints.
  9. Provide users with clear procedures to revoke Microsoft consent, invalidate active tokens, disconnect the integration, and remove the plugin.
  10. Maintain an auditable update policy with security review, release provenance, and rollback support for every plugin version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
| `one_drive_move_item` | Move a file or folder to a new location | Write |
| `one_drive_copy_item` | Copy a file or folder to a new location | Write |
| `one_drive_update_drive_item_metadata` | Update file/folder metadata (rename, move) | Write |
| `one_drive_update_file_content` | Update file content via upload session | Write |
| `one_drive_delete_item` | Delete a file or folder (moves to recycle bin) | Write |
| `one_drive_delete_item_permanently` | Permanently delete a file or folder | Write |

Static analysis

No suspicious patterns detected.