ClawHub
Back to skill

Security audit

Typeform

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Typeform integration that uses ClawLink to access and manage the user's Typeform account, with meaningful setup and data-access risks users should understand.

Install only if you are comfortable connecting Typeform through ClawLink and granting access to forms and responses that may contain personal data. Confirm destructive actions carefully, especially deletes, workspace changes, and webhook registration, and review or revoke the Typeform connection if you stop using the skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:49
Finding

Unpinned Third-Party Plugin Receives Broad Typeform Account Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–55
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

markdown
## Install

Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat.

```bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
text

### Technical Analysis

The skill instructs the agent to install and explicitly allowlist an external plugin using the mutable identifier `clawhub:clawlink-plugin`. It specifies no immutable version, source revision, cryptographic digest, or signature-verification procedure. The audited project also contains no plugin implementation that would permit local review.

After installation, the plugin is trusted to conduct hosted account pairing, store the user's Typeform OAuth token, and proxy Typeform API requests. The available operations include reading potentially personal response data and performing sensitive actions such as modifying forms, registering webhooks, and deleting resources.

Although the document describes the plugin as “verified” and requires user confirmation before installation and write operations, those controls do not establish the integrity of the package resolved at installation time. A compromised registry, publisher account, release, or dependency could therefore place attacker-controlled code inside the trusted plugin boundary.

### Attack Path

1. The user approves the setup described by the skill.
2. OpenClaw resolves and installs the mutable `clawhub:clawlink-plugin` package.
3. The skill modifies OpenClaw configuration to explicitly allow the installed plugin.
4. Restarting the gateway activates the newly trusted component.
5. The user pairs the plugin with ClawLink and grants acces
...[truncated 910 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable, reviewed version and preferably a cryptographic digest rather than installing a mutable package name.
  2. Require package signature and checksum verification before installation, with trust anchored to a documented publisher identity.
  3. Publish or vendor the relevant plugin source so its credential handling, network behavior, update process, and dependency tree can be independently audited.
  4. Generate and retain a software bill of materials, lock transitive dependencies, and scan each release for known vulnerabilities and unexpected ownership changes.
  5. Document the exact Typeform OAuth scopes requested and apply least privilege. Do not grant response-reading, deletion, workspace-management, or webhook permissions unless required for the user's requested task.
  6. Separate read-only and write-capable authorization where supported. Require fresh, explicit confirmation before enabling destructive scopes or operations.
  7. Provide token revocation instructions, minimize token lifetime, encrypt credentials at rest and in transit, and prevent tokens or response contents from appearing in logs.
  8. Restrict plugin network access to documented ClawLink and Typeform endpoints and monitor for anomalous destinations or unexpected API operations.
  9. Revalidate plugin integrity before activation and updates, particularly before restarting the gateway.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.