ClawHub
Back to skill

Security audit

Paystack Payments

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Paystack automation, but it asks users to install and trust an unpinned third-party plugin with stored Paystack credentials and potentially real-money operations.

Review this before installing if the Paystack account contains sensitive or production data. Use a dedicated least-privilege Paystack credential if possible, verify the ClawLink plugin provenance, confirm every write or transfer carefully, and know how to remove the plugin and revoke the Paystack key if you stop using it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Is Granted Access to Financial Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-49; related trust and credential handling at lines 71, 77, and 117
Vulnerability Type: Unpinned third-party dependency and mutable remote tool catalog
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The dependency is subsequently entrusted with Paystack credentials and a remotely supplied tool catalog:

text
**No API key is required in chat.** ClawLink stores the API key securely and injects it into every Paystack API request on the user's behalf.
text
3. Open https://claw-link.dev/dashboard?add=paystack and connect Paystack.
text
3. Treat the returned list as the source of truth. Do not guess or assume what tools exist.

Technical Analysis

The installation command identifies clawlink-plugin only by its mutable registry name. It does not pin an immutable version, package digest, source revision, or trusted signing identity. The instructions then add the plugin to the OpenClaw tool allowlist and restart the gateway, enabling the installed component to participate in subsequent Agent sessions.

The reviewed project contains only SKILL.md; it does not include the plugin implementation, a permission manifest, integrity metadata, or a locally reviewed list of allowed Paystack operations. Consequently, the effective behavior installed from the registry cannot be verified from the audited artifact.

The design also treats a live catalog returned by the external integration service as the source of truth. This creates a mutable trust boundary: tool names, schemas, or capabilities can potentially change after the Skill has been reviewed. ClawLink additionally stores and uses the user's Paystack API key, making compromise of either the package distribution path or hosted servi ...[truncated 1895 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version and require verification against a cryptographic digest or trusted package signature.
  2. Publish the plugin source, reproducible build instructions, dependency lockfile, and permission manifest so the installed implementation can be independently audited.
  3. Use a locally reviewed allowlist of Paystack tool names, parameter schemas, and permitted operation classes rather than granting blanket trust to a mutable remote catalog.
  4. Issue a dedicated Paystack credential with the minimum permissions necessary. Separate read-only access from customer-management, payment, and transfer privileges where supported.
  5. Enforce confirmation for writes and transfers in an independent trusted policy layer outside the third-party plugin. Bind confirmation to the exact recipient, amount, currency, account, and operation payload.
  6. Require reapproval when the plugin version, requested permissions, tool catalog, or tool schema changes.
  7. Protect stored credentials with encryption, strict service-side access controls, audit logging, rotation, and immediate revocation support.
  8. Document how users can uninstall and remove the plugin from tools.alsoAllow, disconnect ClawLink, revoke the Paystack API key, and inspect prior financial activity.
  9. Monitor dependency releases and hosted catalog changes, and block automatic adoption of unreviewed capabilities.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.