Salesforce

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.5

Overview

The Salesforce skill is coherent, but it asks users to install and allowlist an unpinned third-party plugin that can access and change sensitive CRM data.

Review the ClawLink plugin publisher and package provenance before installing. Connect Salesforce with the narrowest OAuth scopes practical, confirm every write preview carefully, and know how to remove the plugin and revoke the Salesforce OAuth connection if needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Third-Party Plugin Installation and Allowlisting

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–50
Vulnerability Type: Unpinned third-party dependency installed and granted gateway trust
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill instructs the user to install clawlink-plugin from ClawHub without specifying an immutable version, cryptographic digest, or verifiable signature. It then adds that plugin to the gateway tool allowlist and restarts the gateway, activating newly downloaded third-party code.

Although the document calls the plugin “verified,” the audited package contains no lockfile, checksum, signature, source code, or version constraint with which to verify the installed artifact. Consequently, the code installed when these instructions are followed may differ from the code reviewed when the skill was published.

This creates a supply-chain trust risk: compromise of the package publisher, registry, distribution path, or a later mutable release could cause users to install and authorize malicious plugin code.

Attack Path

1. An attacker compromises the clawlink-plugin publisher account, package repository, or distribution infrastructure, or causes a malicious mutable release to be served.
2. A user follows the installation instructions in SKILL.md.
3. OpenClaw downloads the current unpinned plugin artifact rather than a specifically audited version.
4. The subsequent configuration command adds the plugin to the gateway tool allowlist.
5. The gateway restart activates the compromised plugin.
6. The plugin can abuse its trusted position and any delegated integration capabilities available to it, potentially issuing unauthorized requests or exposing Salesforce data.

Impact Assessment

Successful exploitation could grant attacker-controlled plugin code the privileges available ...[truncated 711 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an immutable, audited version rather than installing a mutable package name.
2. Verify a cryptographic digest or trusted package signature before installation.
3. Document the authoritative publisher identity and package provenance.
4. Publish a lockfile, checksum manifest, software bill of materials, or equivalent integrity record.
5. Require explicit user approval before modifying the gateway allowlist or restarting the gateway.
6. Avoid automatically allowlisting newly installed plugins; enable only the minimum required tools.
7. Apply least-privilege Salesforce OAuth scopes and deny unnecessary write, file, metadata, and bulk-operation permissions.
8. Preserve mandatory preview and explicit confirmation controls for all write operations, with enforcement outside the mutable plugin where possible.
9. Establish a process to revoke the plugin, rotate OAuth credentials, and investigate Salesforce audit logs if package compromise is detected.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

- Access is scoped to the Salesforce org and OAuth scopes granted during connection.
- **All write operations require explicit user confirmation.** Before executing any create, update, or delete call, confirm the target resource and intended effect with the user.
- Destructive actions (delete account, delete lead, delete opportunity) are marked as high-impact and must be confirmed.
- SOQL and SOSL queries read data without modification — no confirmation required for read operations.

## Tool Reference