ClawHub
Back to skill

Security audit

ServiceNow

Security checks for vulnerabilities and agentic risk

Overview

This ServiceNow skill mostly matches its stated purpose, but it also enables a broad external plugin and includes unrelated SendGrid write examples that could modify the wrong account.

Review before installing. Use this only if you trust the ClawLink plugin source and are comfortable enabling the whole plugin in OpenClaw. Do not run the SendGrid Quick Start examples for a ServiceNow workflow, and require preview plus explicit confirmation before any ServiceNow write, delete, catalog checkout, CMDB, or attachment operation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:48
Finding

Unpinned External Plugin Installation and Broad Tool Allowlisting

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-50
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation workflow retrieves an external plugin by a mutable package identifier without specifying an immutable version, checksum, signature, or reviewed source revision. It then adds the entire plugin to the allowed-tool configuration and restarts the gateway, causing the newly installed executable component to become active.

The audited project contains only SKILL.md; it does not contain the plugin implementation. Consequently, the effective behavior and security properties of the installed component cannot be verified from this artifact. A compromised registry account, malicious package update, or dependency-source compromise could change the plugin behavior after this Skill has been reviewed.

Allowlisting the plugin as a whole rather than an explicit set of required ServiceNow operations further increases the exposed privilege surface. The presence of unrelated SendGrid tools elsewhere in the document demonstrates that the plugin may expose capabilities beyond the declared ServiceNow integration scope.

Attack Path

  1. An attacker compromises the plugin publishing account, distribution channel, or a future mutable release of clawlink-plugin.
  2. A user or Agent follows the documented installation command.
  3. OpenClaw retrieves and installs the compromised plugin because no immutable version or integrity value is required.
  4. The configuration command allowlists the plugin as an available tool provider.
  5. The gateway restart loads the installed component.
  6. The compromised component executes within the plugin's granted context ...[truncated 659 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version or content-addressed release rather than a mutable package identifier.
  2. Verify a cryptographic checksum or trusted publisher signature before installation.
  3. Publish or vendor the exact plugin source used by the Skill so its effective behavior can be audited.
  4. Replace whole-plugin allowlisting with a least-privilege allowlist containing only the ServiceNow tools required by this Skill.
  5. Isolate the plugin in a restricted runtime with minimal filesystem, network, process, and credential access.
  6. Require explicit administrative approval before installation, configuration modification, and gateway restart.
  7. Establish dependency monitoring and revoke affected releases promptly if the publisher or distribution channel is compromised.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:57
Finding

Out-of-Scope SendGrid Operations Exposed by a ServiceNow Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-65
Vulnerability Type: Excessive and unrelated integration capability
Risk Level: Medium

Vulnerable Code

bash
# Get account verification status
clawlink_call_tool --tool "sendgrid_completed_steps"

# Create a new contact
clawlink_call_tool --tool "sendgrid_add_or_update_a_contact" --params '{"contacts": [{"email": "alice@example.com", "first_name": "Alice", "last_name": "Smith"}]}'

# Create a transactional template
clawlink_call_tool --tool "sendgrid_create_a_transactional_template" --params '{"name": "Welcome Email Template"}'

Technical Analysis

The Skill is declared as a ServiceNow IT Service Management integration, but its Quick Start section invokes SendGrid tools. Two examples perform write operations: creating or updating a contact and creating a transactional template.

These operations are unrelated to the stated ServiceNow purpose and violate least-privilege expectations. They also appear as direct clawlink_call_tool commands without the preview and explicit confirmation sequence required later in the document for write operations. This inconsistency could cause an Agent to treat the Quick Start commands as approved examples and execute unrelated account modifications without applying the documented write safeguards.

The contact example additionally transmits personal information to the SendGrid integration. Although the displayed values are illustrative, substituting user-provided data could disclose that data to a service outside the declared ServiceNow workflow.

Attack Path

  1. A user loads the Skill expecting only ServiceNow functionality.
  2. The Agent follows or adapts the Quick Start examples.
  3. The broadly enabled ClawLink plugin resolves the referenced SendGrid tools.
  4. The Agent invokes a SendGrid write operation without first using the documented preview-and-confirm workflow.
  5. Contact data or a tr ...[truncated 862 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all SendGrid commands from the ServiceNow Skill.
  2. Replace them with read-only ServiceNow verification examples, such as listing integrations or retrieving the live ServiceNow tool catalog.
  3. Restrict the Skill and plugin configuration to the servicenow integration and an explicit set of necessary tools.
  4. Ensure every write example performs tool description, preview, explicit user confirmation, and only then execution.
  5. Add runtime validation that rejects tool names whose integration prefix is not servicenow.
  6. Prevent personal or sensitive information from being forwarded to an integration unless the user has explicitly selected that integration and approved the exact destination and operation.
  7. Add automated documentation checks that flag commands referencing integrations inconsistent with the Skill metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Quick Start section for a ServiceNow skill invokes SendGrid tools, which can misdirect an agent or user into performing actions against the wrong integration. In an automation context, this kind of cross-skill mismatch is dangerous because it can cause unintended writes, data manipulation, or confusion about which connected account is being used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file includes commands to restart the OpenClaw gateway and then instructs the user to start a fresh chat, but it does not explicitly warn up front that running the command will interrupt the current session. Because markdown files should disclose behaviors that affect system integrity or workflow continuity, the restart action should be clearly called out before the command block.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
61% confidence
Finding

This file contains natural-language instructions that direct a specific interaction pattern rather than offering it as an option. While not a strong violation, the wording is prescriptive and does not present alternatives or user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.