ClawHub
Back to skill

Security audit

Snowflake

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about connecting Snowflake through ClawLink, but it asks users to install and allowlist an unpinned third-party plugin that will handle Snowflake credentials and broad database actions.

Install only if you trust ClawLink and the ClawHub plugin source. Use a dedicated Snowflake role with the minimum needed permissions, avoid ACCOUNTADMIN or broad write privileges, review SQL before approval, and know how to revoke the ClawLink connection if the plugin or account is no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:52
Finding

Unpinned Third-Party Plugin Receives Privileged Snowflake Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–54 and 73–76
Vulnerability Type: Unpinned and externally managed dependency with access to sensitive credentials and database operations
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The plugin is subsequently trusted to handle Snowflake authentication:

text
All Snowflake tool calls are authenticated automatically by ClawLink using the user's connected Snowflake account credentials.

No credentials are required in chat. ClawLink stores the connection credentials securely and injects them into every Snowflake API request on the user's behalf.

Technical Analysis

The Skill instructs the user or agent to install clawhub:clawlink-plugin without specifying an immutable version, cryptographic digest, or verified source revision. It then explicitly allowlists the plugin and restarts the OpenClaw gateway, activating third-party code whose implementation is not included in the audited project.

The same dependency is trusted to store or mediate Snowflake credentials and proxy authenticated requests. Its exposed capabilities include raw SQL execution, DDL and DML operations, warehouse administration, user and role enumeration, and file uploads to internal stages. Because the plugin source and version are absent, the audit cannot verify its credential handling, confirmation enforcement, request validation, update behavior, or resistance to supply-chain compromise.

A mutable dependency identifier means that code installed at a later time may differ from the code originally reviewed or expected. If the registry entry, publisher account, release pipeline, or plugin distribution channel is compromised, malicious code could execute with the permissions granted to the plugin and connect ...[truncated 2071 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version rather than installing a mutable package identifier.
  2. Require cryptographic signature and digest verification before installation and before every update.
  3. Publish or bundle the plugin source and reproducible build metadata so its credential handling and operation-confirmation controls can be independently audited.
  4. Use a dedicated Snowflake service identity or role with only the minimum permissions required for the requested workflow.
  5. Separate read-only and write-capable integrations. Do not grant DDL, DML, warehouse administration, user administration, or stage-write privileges unless explicitly required.
  6. Enforce write approval outside the third-party plugin so a compromised dependency cannot bypass confirmation requirements.
  7. Restrict outbound communication to documented ClawLink and Snowflake endpoints and monitor for unexpected network destinations.
  8. Document credential storage, encryption, retention, rotation, revocation, and incident-response procedures.
  9. Log and audit all plugin installation events, updates, Snowflake queries, administrative operations, and stage uploads.
  10. Provide an explicit uninstall and credential-revocation procedure for suspected plugin or supply-chain compromise.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.