WakaTime

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.1

Overview

This skill appears intended for WakaTime stats, but it should be reviewed because it installs and trusts an external plugin and broadly treats private activity-data reads as needing no confirmation.

Install only if you trust the ClawLink plugin source and are comfortable granting it read access to WakaTime data. Prefer a pinned, reviewed plugin version when available, and require explicit confirmation before retrieving profile, project, machine, goal, insight, or summary data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Plugin Installation and Allowlisting

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-35
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation procedure retrieves clawlink-plugin from a third-party package registry without specifying an immutable version, source revision, cryptographic checksum, or signature. The plugin's implementation is not included in the audited project, so its behavior and integrity cannot be verified from the available files.

The following commands then add the plugin to the tool allowlist and restart the gateway, causing the retrieved package to be trusted and loaded. Because the dependency is mutable, the code installed by a user may differ from the code that existed when this skill was reviewed.

This creates a supply-chain risk: compromise of the registry entry, publisher account, package distribution infrastructure, or a later release could introduce attacker-controlled behavior.

Attack Path

1. An attacker compromises the plugin publisher account, registry entry, or package distribution channel, or publishes a malicious later release under the same package identity.
2. A user follows the documented command without specifying a trusted immutable version.
3. OpenClaw downloads the currently available package, including the attacker's changes.
4. The user explicitly adds clawlink-plugin to tools.alsoAllow.
5. The gateway restart loads and activates the compromised plugin.
6. The malicious plugin executes with the permissions available to an OpenClaw plugin and may intercept integration requests or access data exposed through the OAuth-mediated workflow.

Impact Assessment

Successful exploitation could permit attacker-controlled plugin code to operate within the OpenClaw plugin environment. The pr ...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an immutable, reviewed version or source commit rather than installing the latest package implicitly.
2. Publish and verify a cryptographic checksum or trusted publisher signature before installation.
3. Link to the plugin's auditable source code and document the exact source revision corresponding to the pinned release.
4. Document the plugin's required permissions, OAuth scopes, network destinations, and data-handling behavior.
5. Separate installation from allowlisting so integrity and permission checks occur before the plugin is trusted.
6. Apply least privilege to the plugin's filesystem, network, credential, and tool access.
7. Establish dependency monitoring and a controlled update process in which each new version is reviewed before deployment.
8. Where supported, configure the package manager to reject unsigned packages or artifacts whose integrity metadata does not match.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill explicitly states that all calls are safe and require no confirmation, which encourages the agent to execute external API actions autonomously without user approval. Even if the listed tools are read-only, they expose potentially sensitive productivity and behavioral data such as coding activity, projects, machines, editors, and goals; treating them as always safe can bypass user-consent expectations and lead to privacy leakage.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

## Security & Permissions

All WakaTime tools are read-only. No write operations are available. All calls are safe and require no confirmation.

## Tool Reference

Static analysis

No suspicious patterns detected.