ClawHub
Back to skill

Security audit

Vercel

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Vercel, but it asks users to install and allowlist an external plugin that can mediate broad Vercel account actions and credentials.

Install only if you trust ClawLink and are comfortable granting it Vercel access. Before connecting, review the OAuth scopes, use the least-privileged Vercel account or team role practical, confirm every write or destructive action carefully, and know how to revoke the Vercel connection and remove the plugin allowlist entry.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:47
Finding

Unpinned Third-Party Plugin Is Granted Privileged Vercel Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-49 and 71-77
Vulnerability Type: Insecure third-party dependency and supply-chain trust
Risk Level: High

Vulnerable Code

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart
markdown
**No API token is required in chat.** ClawLink stores the token securely and injects it into every Vercel API request on the user's behalf.

### Getting Connected

1. Install the ClawLink plugin (see Install above).
2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet.
3. Open https://claw-link.dev/dashboard?add=vercel and connect Vercel.
4. Call `clawlink_list_integrations` to verify the connection is active.

Technical Analysis

The skill instructs the user or agent to install and allowlist clawlink-plugin, restart the OpenClaw gateway so that it becomes active, and connect a Vercel account through an external ClawLink service. The dependency is referenced only by a mutable package identifier. The audited artifact does not pin an immutable version or digest, verify a package signature, include auditable plugin source code, or provide reproducible-build evidence.

The external service also mediates the user's Vercel token and injects it into API requests. Consequently, the security of privileged Vercel operations depends on code and infrastructure that are outside the reviewed project. Although the document describes the plugin as verified and states that tokens are stored securely, those claims cannot be independently validated from the sole audited file.

Attack Path

  1. A user follows the skill's instructions and installs the unpinned plugin from ClawHub.
  2. The plugin is added to tools.alsoAllow, and the OpenClaw gateway is restarted to load it.
  3. The user pairs the plugin with ClawLink and grants Vercel O ...[truncated 1306 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an immutable version and cryptographic digest rather than installing a mutable package name.
  2. Require publisher-signature and checksum verification before installation or activation.
  3. Publish the plugin source, release provenance, dependency manifest, and reproducible-build instructions for independent review.
  4. Document the exact Vercel OAuth scopes requested and use least-privilege, task-specific authorization instead of broad account access.
  5. Prefer direct or locally controlled token handling where feasible. If hosted token custody is required, document encryption, retention, access controls, auditability, breach handling, and revocation procedures.
  6. Require explicit user confirmation before plugin installation, allowlist modification, gateway restart, OAuth connection, sensitive reads, and every write or destructive operation.
  7. Add short-lived credentials, periodic authorization review, request-level audit logging, anomaly detection, and an immediate disconnect-and-revoke procedure.
  8. Separate read-only tools from administrative tools and avoid exposing secret, team-management, or destructive capabilities unless specifically needed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.