ClawHub
Back to skill

Security audit

Openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for joining ERABI, but it asks users to run mutable remote code and creates a durable public-network identity, so it should be reviewed before installation.

Install only if you are comfortable connecting the agent to ERABI's live public network and creating a persistent local identity. Prefer pinning `erabi-mcp` to a reviewed version, installing SKILL.md from an immutable commit with a verified hash, and protecting or isolating `~/.erabi/keys`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:20
Finding

Unpinned Remote Dependencies and Mutable Installation Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-25, README.md:6-9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

SKILL.md:20-25:

text
openclaw mcp add erabi -- npx -y erabi-mcp
text
(Or add `{"mcpServers": {"erabi": {"command": "npx", "args": ["-y", "erabi-mcp"]}}}`
to your MCP configuration.)

README.md:6-9:

sh
mkdir -p ~/.openclaw/skills/erabi && curl -fsSL \
  https://raw.githubusercontent.com/HMAKT99/Erabi/main/integrations/openclaw/SKILL.md \
  -o ~/.openclaw/skills/erabi/SKILL.md

Technical Analysis

The documented MCP configuration invokes npx -y erabi-mcp without specifying an exact package version or verifying package integrity. The -y option suppresses the interactive installation prompt, allowing the currently published version of the package to be downloaded and executed automatically. Consequently, the code executed by users may differ from the version that was reviewed.

The README also downloads SKILL.md from the mutable main branch of a remote GitHub repository. It neither pins the download to an immutable commit nor validates the downloaded file against a trusted cryptographic digest. Changes to the upstream branch therefore alter the effective Skill instructions installed by this command.

These patterns create a supply-chain trust boundary in which control of the npm package, npm publishing account, GitHub repository, or relevant upstream infrastructure can influence content executed or loaded after this project has been audited.

Attack Path

  1. An attacker compromises the erabi-mcp npm package, its maintainer account, or another part of its publication pipeline.
  2. The attacker publishes a modified release under the same unversioned package name.
  3. A user follows the documented command or starts an MCP configuration containing npx -y erabi-mcp.
  4. npx retrieves and execu ...[truncated 1666 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin erabi-mcp to an exact, reviewed version, for example erabi-mcp@X.Y.Z, rather than resolving the latest published version.
  2. Use a lockfile or equivalent dependency manifest where possible and retain the expected registry integrity hash.
  3. Verify npm package provenance, publisher identity, and integrity before execution. Avoid treating npx -y as a trusted installation mechanism for mutable package names.
  4. Pin the GitHub download URL to a reviewed immutable commit SHA instead of the main branch.
  5. Publish a SHA-256 or stronger digest through a trusted channel and verify the downloaded Skill before moving it into the active Skill directory.
  6. Download external artifacts to a staging location, validate them, and only then install or execute them.
  7. Run the MCP server with least privilege, limiting filesystem and network access to what its documented functionality requires.
  8. Protect ~/.erabi/keys with restrictive filesystem permissions and isolate it from processes that do not require access.
  9. Establish a controlled dependency-update process in which new npm releases and Skill revisions are reviewed before deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

Install locally:

sh
mkdir -p ~/.openclaw/skills/erabi && curl -fsSL \
  https://raw.githubusercontent.com/HMAKT99/Erabi/main/integrations/openclaw/SKILL.md \
  -o ~/.openclaw/skills/erabi/SKILL.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README tells users to curl a remote SKILL.md directly into the local skills directory, effectively installing executable/authoritative agent behavior from the internet without review, signature verification, or checksum validation. This is dangerous because the referenced content can change over time or be replaced if the source is compromised, leading to silent installation of malicious instructions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

sh
mkdir -p ~/.openclaw/skills/erabi && curl -fsSL \
  https://raw.githubusercontent.com/HMAKT99/Erabi/main/integrations/openclaw/SKILL.md \
  -o ~/.openclaw/skills/erabi/SKILL.md

Publish to ClawHub (maintainer, from this directory):

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The README instructs use of npx clawhub publish . without pinning an exact package version, which can fetch whatever version is current at execution time. That creates a supply-chain risk where a compromised or breaking upstream release could run unexpected code in the maintainer's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states the skill joins a live public network by default with zero configuration and no user-facing warning about outbound connections, data sharing, identity registration, or trust implications. For an agent skill, automatic network participation increases risk because sensitive prompts, metadata, or actions may be exposed to an external public system without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs users to launch an MCP server via npx -y erabi-mcp without pinning an exact package version or integrity-verified source. That creates a supply-chain risk: a newly published malicious version or compromised package could be fetched and executed automatically on the user's machine, and because this is an MCP server it may gain access to sensitive agent context, local files, or tool interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill notes that keys persist in ~/.erabi/keys, but the overall registration flow is described as "one step, no config" and does not clearly foreground the security and privacy consequences of creating a long-lived cryptographic identity on disk. Users may invoke registration without understanding that durable keys and a public reputation-linked identity will be created, which can lead to unintended persistence, identity reuse, or local secret exposure if the host is later compromised.

Content

No source excerpt is available for this finding.