ClawHub
Back to skill

Security audit

Strava

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for Strava integration, but it asks users to install and allowlist an unpinned third-party plugin that can persist across chats and mediate sensitive Strava access.

Install only if you trust ClawLink and the ClawHub plugin source. Before connecting Strava, review the OAuth scopes, prefer read-only access when possible, and be careful with write operations such as deleting activities, changing routes or equipment, posting comments, giving kudos, or joining/leaving clubs. Revoke the Strava connection and remove the plugin if you stop using it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned Third-Party Plugin Installation and Activation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–47
Vulnerability Type: Unreviewed and unpinned third-party dependency
Risk Level: Medium

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill instructs the user or agent to install a third-party plugin, add it to the OpenClaw tool allowlist, and restart the gateway to activate it. The installation command does not pin an immutable plugin version or cryptographic digest. Consequently, the installed implementation can differ from the version that existed when this skill was audited.

The plugin's source code is not included in the audited project, so its handling of OAuth credentials, API requests, and local tool execution cannot be independently assessed here. Describing the package as “verified” does not supply locally auditable integrity evidence or eliminate the supply-chain risk.

Attack Path

  1. An attacker compromises the plugin package, its publisher account, distribution infrastructure, or a future mutable release.
  2. A user follows the documented setup and installs clawhub:clawlink-plugin without an immutable version or digest.
  3. The setup explicitly adds the plugin to tools.alsoAllow.
  4. Restarting the OpenClaw gateway loads and activates the installed plugin.
  5. The user pairs the plugin and connects a Strava account through the hosted OAuth flow.
  6. The compromised plugin observes or manipulates OAuth-backed Strava requests and may misuse the available read or write operations within the granted scopes.

Impact Assessment

A compromised dependency could execute with the permissions granted to the OpenClaw plugin and access data made available through the connected Strava integration. Depending on OAuth scopes and local plugin privileges, exposed data could include athlete profile informati ...[truncated 550 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, security-reviewed version rather than installing a mutable package reference.
  2. Verify the package using a publisher signature or cryptographic digest before installation and fail closed if verification does not succeed.
  3. Publish the plugin source and reproducible-build information so its effective behavior can be independently audited.
  4. Require explicit, informed user consent before installation, allowlisting, gateway restart, account pairing, and OAuth authorization.
  5. Request only the minimum Strava OAuth scopes needed for the user's requested operation and separate read-only access from write access where possible.
  6. Constrain the plugin through process isolation, restricted filesystem and network access, and a narrowly scoped tool allowlist.
  7. Enforce write confirmation outside the plugin, at a trusted mediation layer, so a compromised dependency cannot bypass confirmation requirements.
  8. Document package provenance, version-update policy, rollback procedures, token revocation steps, and incident-response guidance.
  9. Log plugin installation, OAuth connection, sensitive reads, and write operations without recording tokens or unnecessary personal data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.