ClawHub
Back to skill

Security audit

PhantomBuster Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PhantomBuster integration that uses ClawLink to connect accounts and requires confirmation before write actions.

Before installing, confirm you trust the ClawLink plugin source and understand that it will be enabled in OpenClaw and used to make authenticated PhantomBuster API calls. Review previews carefully before approving any write, delete, or automation launch because those actions can affect your PhantomBuster account and third-party systems.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:45
Finding

Unpinned Third-Party Plugin Installation and Activation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–49
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The same allowlisting and restart instructions are repeated in the troubleshooting procedure at SKILL.md, lines 211–215:

bash
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The setup procedure installs executable third-party plugin code from the ClawHub package source, explicitly adds that plugin to OpenClaw's allowed tools, and restarts the gateway so the installed component becomes active.

The dependency is referenced only as clawhub:clawlink-plugin. No exact version, immutable artifact digest, lockfile, or required signature verification procedure is provided. Consequently, the effective code installed by users can change after this skill has been reviewed. The plugin implementation is not included in the audited project, so its behavior and permission boundaries cannot be verified from the available artifact.

Although the document describes the plugin as “verified,” that statement is not accompanied by locally verifiable integrity information. This creates supply-chain exposure if the package, publisher account, distribution service, or mutable release is compromised.

Attack Path

  1. An attacker compromises the plugin publisher account, package distribution channel, or an unpinned future release of clawlink-plugin.
  2. The attacker publishes a modified plugin under the package identifier used by the skill.
  3. A user follows the documented setup instructions and installs the package without validating a version or cryptographic digest.
  4. The configuration command explicitly allowlists the installed plug ...[truncated 1139 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an exact, reviewed version rather than installing a mutable package reference.
  2. Pin and verify a cryptographic digest for the distributed artifact before installation.
  3. Require package-signature verification and document the trusted publisher identity and signing key.
  4. Publish the plugin source and reproducible-build instructions so the distributed artifact can be compared with reviewed source code.
  5. Use a dependency lockfile or an equivalent immutable dependency manifest.
  6. Review the plugin's requested permissions and grant only those required for PhantomBuster operations.
  7. Do not automatically allowlist or activate the plugin until its origin and integrity have been validated.
  8. Add guidance for safely rolling back and revoking the plugin if its package or publisher is compromised.
  9. Apply the same integrity checks to the troubleshooting procedure before it re-enables and reloads the plugin.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.