ClawHub
Back to skill

Security audit

SendGrid

Security checks for vulnerabilities and agentic risk

Overview

This SendGrid skill is coherent and disclosed, but it asks users to allowlist an unpinned external plugin and route a powerful SendGrid API key through a hosted proxy that is not included for review.

Review this before installing if your SendGrid account is business-critical. Use a dedicated SendGrid API key with the minimum scopes needed, avoid granting account-admin/API-key/SSO/teammate permissions unless necessary, and revoke or rotate the key if you stop using ClawLink.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Plugin and Hosted Credential Proxy

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-50 and line 70
Vulnerability Type: Unverified third-party dependency and credential intermediary
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text
All SendGrid tool calls are authenticated automatically by ClawLink using your SendGrid API key stored securely in the dashboard.

Technical Analysis

The setup installs a third-party plugin without pinning an immutable version or verifying a checksum or signature. It then explicitly adds that plugin to OpenClaw's allowed tools and restarts the gateway, causing the installed component to become active.

The skill also directs users to entrust their SendGrid API key to ClawLink's hosted dashboard. The audited project contains only SKILL.md; it does not include the plugin implementation or server-side credential-handling code. Consequently, this audit cannot verify the plugin's behavior, credential storage controls, request integrity, update process, or enforcement of least privilege.

This creates a supply-chain trust boundary in which a mutable external component can exercise the permissions granted to the connected SendGrid API key. The risk is amplified by the documented catalog's sensitive operations, including API-key creation at line 232 and administrative access approval at line 242.

Attack Path

  1. An attacker compromises the plugin package, its publisher account, distribution infrastructure, or hosted ClawLink service.
  2. The user follows the skill instructions and installs the unpinned clawlink-plugin.
  3. OpenClaw explicitly allowlists the plugin and restarts its gateway, activating the potentially modified component.
  4. The user connects SendGrid and supplies an API key through the hosted dashboard.
  5. The compromised intermediary receives or uses the connected ac ...[truncated 1140 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing an unspecified current release.
  2. Verify the package with a cryptographic signature or published checksum before installation.
  3. Publish auditable plugin source code and reproducible-build information so users can verify the distributed artifact.
  4. Document the plugin publisher's update process, compromise-response procedure, credential-retention policy, encryption controls, and request-logging practices.
  5. Create a dedicated SendGrid API key with only the minimum scopes needed for the intended workflow.
  6. Do not grant API-key administration, teammate approval, SSO administration, reseller provisioning, or other account-level permissions unless explicitly required.
  7. Separate high-risk administrative tools from routine email tools and require independent authorization for their activation.
  8. Support direct SendGrid authentication or locally controlled credential storage where feasible, reducing reliance on a hosted credential intermediary.
  9. Require explicit confirmation for plugin installation, allowlisting, gateway restart, account connection, and every sensitive write operation.
  10. Periodically rotate the SendGrid key, review SendGrid audit activity, and revoke the integration immediately if unexpected operations are detected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.