ClawHub
Back to skill

Security audit

PagerDuty Incidents

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it asks users to install and allow an unpinned third-party plugin that can mediate PagerDuty credentials and operational changes.

Review this before installing if your PagerDuty account can make production changes. Use least-privilege PagerDuty access, confirm every write carefully, and prefer a pinned or verified ClawLink plugin release if available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Is Granted Access to PagerDuty Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-49 and 71-77
Vulnerability Type: Unpinned third-party dependency with access to externally mediated credentials and API operations
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
markdown
**No API key is required in chat.** ClawLink stores the API key securely and injects it into every PagerDuty API request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=pagerduty and connect PagerDuty.

Technical Analysis

The skill directs the user to install clawhub:clawlink-plugin without specifying an immutable version, package digest, checksum, or signature. It then adds that plugin to OpenClaw's allowed tools and restarts the gateway so the installed component becomes active.

PagerDuty authentication and API requests are subsequently mediated by ClawLink. The project contains only SKILL.md; it does not include the plugin implementation or other code that would permit verification of package behavior, credential isolation, request validation, update controls, or integrity protections.

This creates a supply-chain trust boundary. If the mutable package, its publisher account, its distribution channel, or its release process is compromised, a later installation could resolve to code different from the code originally reviewed. The available evidence does not demonstrate that the current plugin is malicious, and it does not establish that the plugin directly receives the raw PagerDuty API key. The risk is that an unverified component is authorized to participate in sensitive PagerDuty operations.

Attack Path

  1. An attacke ...[truncated 1744 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version and preferably to a cryptographic package digest rather than installing a mutable package identifier.
  2. Require package signature and checksum verification before installation, and fail closed when verification cannot be completed.
  3. Publish the plugin source and reproducible build instructions so the installed artifact can be compared with the reviewed source.
  4. Document the exact local permissions, PagerDuty scopes, credential boundaries, data retention behavior, and network destinations used by the plugin and hosted service.
  5. Apply least privilege to the connected PagerDuty account. Use read-only scopes unless write access is explicitly required, and avoid administrator-level credentials.
  6. Separate read and write capabilities. Continue requiring an explicit preview and user confirmation for every state-changing operation, and enforce this control in trusted code rather than documentation alone.
  7. Restrict plugin egress to documented ClawLink and PagerDuty endpoints where the host platform supports network policy enforcement.
  8. Provide package provenance, release attestations, security contact information, and a documented dependency revocation or rollback process.
  9. Consider offering direct PagerDuty OAuth or API authentication so users can avoid an additional credential and request-mediation trust boundary.
  10. Audit and log integration calls, alert on unexpected write operations, and provide an immediate mechanism to revoke the PagerDuty connection and disable the plugin.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.