ClawHub
Back to skill

Security audit

Stack Exchange

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Stack Exchange integration, but it asks users to install and allowlist an external plugin while exposing private OAuth-backed account data and token-inspection tools with weak consent guidance.

Install only if you trust ClawLink and are comfortable granting OAuth-backed access to Stack Exchange account data. Prefer using public search tools without connecting OAuth when possible, avoid granting read_inbox unless you need inbox or notification features, and treat token-inspection output as sensitive. Verify the plugin package/version before allowlisting it in OpenClaw.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:31
Finding

Unpinned Third-Party Plugin Is Installed and Added to the Agent Tool Allowlist

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:192
Finding

Sensitive OAuth-Backed Account Capabilities Exceed the Needs of Public Q&A Retrieval

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

A tool explicitly described as able to 'verify and inspect OAuth access tokens' creates a credential-access surface inside the skill. Even if intended for troubleshooting, exposing token inspection capability to the agent increases the risk of secret disclosure, token mishandling, or downstream abuse if outputs are logged, summarized, or shown to unauthorized users.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md
|------|-------------|------|
| `stack_exchange_create_filter` | Create a custom response filter | Write |
| `stack_exchange_get_filters_by_ids` | Retrieve filter field definitions | Read |
| `stack_exchange_get_access_tokens` | Verify and inspect OAuth access tokens | Read |

## Code Examples

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The statement that read operations 'require no confirmation' encourages autonomous execution based solely on the skill's self-assessment of safety. In this skill, many 'read' tools can access authenticated user data such as inbox, notifications, reputation history, associated accounts, and token inspection, so removing confirmation can expose sensitive information without explicit user consent.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
## Security & Permissions

- **Read** operations are safe and require no confirmation. All Stack Exchange tools in this integration are read-only or create filters.
- **Write** operations are limited to creating custom filters, which are safe helper objects.
- The Stack Exchange API has a daily request quota. Monitor `quota_remaining` in responses.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

md
## Resources

- Stack Exchange API Docs: https://api.stackexchange.com/docs
- ClawLink: https://claw-link.dev/?utm_source=clawhub&utm_medium=referral&utm_content=stack-exchange
- ClawLink Docs: https://docs.claw-link.dev/openclaw

Static analysis

No suspicious patterns detected.