ClawHub
Back to skill

Security audit

RocketReach

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed RocketReach contact-intelligence connector, but users should review the third-party ClawLink plugin and credit-consuming lookups before use.

Before installing, confirm you trust the ClawLink plugin and hosted credential flow, understand that RocketReach lookups can reveal personal contact data and consume account credits, and ask the agent to confirm each lookup target before running searches or bulk actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Unpinned Third-Party Plugin Installation and Broad Enablement

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–55
Vulnerability Type: Unpinned third-party dependency installed from an external package registry
Risk Level: Medium

bash
## Install

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

```bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text

### Technical Analysis

The installation command identifies `clawlink-plugin` by package name without pinning an immutable version or content digest. The Skill provides no checksum, signature-verification command, lock file, or locally auditable plugin source. Consequently, the code installed at execution time may differ from the component that existed when this Skill was reviewed.

The subsequent configuration command adds the plugin to OpenClaw's allowed tools, and the gateway restart loads the installed component. The statement that the plugin is “verified” does not provide a reproducible integrity control within the audited project.

Exploitation requires compromise or malicious modification of the upstream package, its publisher account, registry resolution, or another component in the distribution chain. There is no evidence in the audited file that the current plugin is malicious; the issue is the unsafe, mutable dependency trust model.

### Attack Path

1. An attacker compromises the plugin publisher, package registry, release process, or package-name resolution path.
2. The attacker publishes or substitutes a malicious release under `clawhub:clawlink-plugin`.
3. A user follows the Skill and runs the unversioned installation command.
4. OpenClaw resolves and installs the attacker-controlled package.
5. The configuration command allows the plugin as an available tool.
6. Restarting the gateway loads the installed plugin.
7. Malicio
...[truncated 837 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a reviewed, immutable version and preferably a cryptographic content digest rather than resolving only by package name.
  2. Publish an expected SHA-256 digest or equivalent integrity value and require verification before installation.
  3. Require package-signature verification against a documented, trusted publisher key.
  4. Provide a link to the exact reviewed source revision and reproducible build instructions so the distributed artifact can be independently compared with its source.
  5. Use a lock file or equivalent dependency manifest to prevent silent upgrades.
  6. Scope plugin access to the minimum RocketReach and ClawLink tools required instead of broadly enabling the entire plugin where OpenClaw supports finer-grained controls.
  7. Document the plugin runtime's filesystem, network, credential, and process permissions, and disable capabilities unnecessary for RocketReach lookups.
  8. Require explicit user approval before installation, account pairing, credit-consuming calls, or permission changes.
  9. Establish a controlled update process that repeats source review and integrity verification before changing the pinned release.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that all operations require explicit user confirmation, but elsewhere classifies read operations as safe and provides direct execution examples without a confirmation step. In a contact-intelligence skill, even read actions can expose personal data and consume paid API credits, so this inconsistency can cause agents to perform privacy-impacting lookups without informed user approval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and tool reference describe this skill as search, lookup, and account/company/person read operations, and every listed tool is marked Read. The 'Write rejected' error entry introduces write behavior that the rest of the file does not document, creating an intent mismatch in the skill documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.