ClawHub
Back to skill

Security audit

Tally

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tally integration guide that installs ClawLink and tells the agent to confirm before write or delete actions.

Before installing, confirm you trust ClawLink and the ClawHub package being resolved, and connect only the Tally account whose forms and submissions you want OpenClaw to access. Review previews carefully before approving form, field, workflow, notification, submission, or delete operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Privileged Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-47
Vulnerability Type: Unpinned third-party dependency with privileged tool access
Risk Level: Medium

bash
## Install

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references clawhub:clawlink-plugin without an immutable version, cryptographic digest, or other integrity constraint. The subsequent command explicitly adds the plugin to the permitted tool list, and the gateway restart activates it.

Because the installed artifact is mutable from the perspective of this reviewed skill, its effective behavior can change independently of SKILL.md. The skill does not provide a mechanism to verify that the downloaded package is the same package that was previously audited. This creates a supply-chain exposure if the registry, publisher account, package namespace, or plugin release process is compromised.

The reviewed file does not establish that the plugin is malicious. The issue is that a privileged external component is installed and trusted without reproducible version or integrity verification.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry, release pipeline, or an otherwise mutable unpinned release.
  2. The attacker publishes a modified artifact under the existing clawlink-plugin identifier.
  3. A user follows the skill instructions and runs openclaw plugins install clawhub:clawlink-plugin.
  4. OpenClaw resolves and installs the attacker-controlled package because no trusted version or digest is specified.
  5. The configuration command allowlists the installed plugin.
  6. Restarting the gateway ...[truncated 999 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a specifically reviewed version rather than resolving the package by an unversioned name.
  2. Where supported, pin and verify an immutable cryptographic digest or signed package identity.
  3. Verify the publisher signature, registry provenance, and package checksum before installation and activation.
  4. Document the exact plugin permissions, OAuth scopes, network destinations, and data categories available to the plugin.
  5. Apply least privilege by allowing only the specific Tally operations required for the user's request instead of granting broader plugin access.
  6. Require separate, explicit user confirmation before installing the plugin, changing the tool allowlist, and restarting the gateway.
  7. Review the resolved plugin artifact and its transitive dependencies before deployment.
  8. Establish a trusted update process that re-audits new versions and rejects unexpected package or digest changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.