ClawHub
Back to skill

Security audit

Salesforce

Security checks for vulnerabilities and agentic risk

Overview

The Salesforce skill is coherent, but it asks users to install and allowlist an unpinned third-party plugin that can access and change sensitive CRM data.

Review the ClawLink plugin publisher and package provenance before installing. Connect Salesforce with the narrowest OAuth scopes practical, confirm every write preview carefully, and know how to remove the plugin and revoke the Salesforce OAuth connection if needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding
Unpinned Third-Party Plugin Installation and Allowlisting## Vulnerability Details **File Location**: `SKILL.md`, lines 46–50 **Vulnerability Type**: Unpinned third-party dependency installed and granted gateway trust **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ### Technical Analysis The skill instructs the user to install `clawlink-plugin` from ClawHub without specifying an immutable version, cryptographic digest, or verifiable signature. It then adds that plugin to the gateway tool allowlist and restarts the gateway, activating newly downloaded third-party code. Although the document calls the plugin “verified,” the audited package contains no lockfile, checksum, signature, source code, or version constraint with which to verify the installed artifact. Consequently, the code installed when these instructions are followed may differ from the code reviewed when the skill was published. This creates a supply-chain trust risk: compromise of the package publisher, registry, distribution path, or a later mutable release could cause users to install and authorize malicious plugin code. ### Attack Path 1. An attacker compromises the `clawlink-plugin` publisher account, package repository, or distribution infrastructure, or causes a malicious mutable release to be served. 2. A user follows the installation instructions in `SKILL.md`. 3. OpenClaw downloads the current unpinned plugin artifact rather than a specifically audited version. 4. The subsequent configuration command adds the plugin to the gateway tool allowlist. 5. The gateway restart activates the compromised plugin. 6. The plugin can abuse its trusted position and any delegated integration capabilities available to it, potentially issuing unauthorized requests or exposing Salesforce data. ### Impact Assessment Successful exploitation could grant attacker-controlled plugin code the privileges available ...[truncated 711 chars]
Remediation
## Remediation Suggestions 1. Pin the plugin to an immutable, audited version rather than installing a mutable package name. 2. Verify a cryptographic digest or trusted package signature before installation. 3. Document the authoritative publisher identity and package provenance. 4. Publish a lockfile, checksum manifest, software bill of materials, or equivalent integrity record. 5. Require explicit user approval before modifying the gateway allowlist or restarting the gateway. 6. Avoid automatically allowlisting newly installed plugins; enable only the minimum required tools. 7. Apply least-privilege Salesforce OAuth scopes and deny unnecessary write, file, metadata, and bulk-operation permissions. 8. Preserve mandatory preview and explicit confirmation controls for all write operations, with enforcement outside the mutable plugin where possible. 9. Establish a process to revoke the plugin, rotate OAuth credentials, and investigate Salesforce audit logs if package compromise is detected.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Access is scoped to the Salesforce org and OAuth scopes granted during connection.
- **All write operations require explicit user confirmation.** Before executing any create, update, or delete call, confirm the target resource and intended effect with the user.
- Destructive actions (delete account, delete lead, delete opportunity) are marked as high-impact and must be confirmed.
- SOQL and SOSL queries read data without modification — no confirmation required for read operations.

## Tool Reference
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.