Webex

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Webex integration, but it asks users to install and broadly authorize an unpinned external plugin that can perform sensitive Webex actions.

Review the ClawLink plugin publisher, version, and OAuth scopes before installing. Use a dedicated Webex account or least-privilege OAuth grant where possible, and be cautious with message deletion, membership changes, room or team updates, and webhook creation because those actions can affect other users and may be irreversible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33

Finding

Unpinned Third-Party Plugin Installation and Broad Tool Authorization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–35
Vulnerability Type: Unpinned external dependency and broad plugin authorization
Risk Level: Medium

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation command references clawlink-plugin without an immutable version, cryptographic digest, or signature-verification step. Consequently, the component installed later may differ from the component originally reviewed. Compromise of the package publisher, registry, distribution channel, or a future package release could introduce unauthorized behavior.

The subsequent configuration command permits the entire plugin as an OpenClaw tool, and the gateway restart loads that permitted component. The project contains only SKILL.md; it does not include the plugin implementation, dependency lock data, or integrity metadata. Therefore, the plugin's credential handling, network behavior, tool implementation, and claimed confirmation controls cannot be independently verified within the audited artifact.

This finding identifies a supply-chain exposure rather than proof that the current external plugin is malicious.

Attack Path

1. An attacker compromises the mutable plugin release, publisher account, or package distribution channel.
2. A user follows SKILL.md and installs clawhub:clawlink-plugin without pinning or integrity verification.
3. The user adds the plugin to tools.alsoAllow.
4. Restarting the gateway loads the compromised plugin.
5. The plugin operates through the connected ClawLink/Webex trust boundary.
6. Depending on the effective OAuth scopes and local tool permissions, the compromised component reads Webex information, performs unauthorized Webex operations, or transmits accessible data to an attacker-controlled destination.

Impact Assessment

Successful exploitation coul ...[truncated 582 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version and, where supported, an immutable cryptographic digest.
2. Verify package signatures or published checksums before installation and fail closed when verification is unavailable or unsuccessful.
3. Document the authoritative registry, exact publisher identity, expected signing key, and package provenance.
4. Publish or vendor the reviewed plugin source so its credential handling, network destinations, confirmation controls, and tool behavior can be audited.
5. Maintain a lockfile or equivalent integrity record covering the plugin and its transitive dependencies.
6. Replace whole-plugin authorization with an explicit allowlist containing only the Webex tools required for the intended workflow.
7. Require user confirmation at an independently enforced boundary for messaging, deletion, membership changes, room or team modification, and webhook management.
8. Restrict Webex OAuth scopes according to least privilege and provide procedures for revoking both OAuth grants and local plugin authorization.
9. Review and approve plugin updates before deployment rather than automatically accepting mutable releases.
10. Run the integration in an isolated environment with restricted filesystem, process, and outbound-network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broad enough to trigger on many generic collaboration or messaging requests, which can cause the agent to select this skill in situations where the user did not specifically intend to use Webex. Because the skill enables read, write, delete, and webhook-management actions against a connected enterprise communication platform, overbroad activation increases the chance of unintended data access or destructive operations after selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.