ClawHub
Back to skill

Security audit

test vercel

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned as an update and rollback helper, but it asks users to install an unverified external CLI and run high-impact system update workflows without enough scoping or warning.

Install only if you trust the external OpenClaw CLI source and can verify the exact binary through independent release, checksum, or signature information. Treat the provided deployment examples as production-impacting: review every command, test in a non-production environment, require explicit approvals, and avoid privileged or multi-server execution until rollback and backup behavior is independently validated.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned and Unverified External CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-20
Vulnerability Type: Unverified third-party executable dependency
Risk Level: High

Vulnerable Code Snippet

markdown
**OpenClaw CLI must be installed before using this skill.**

Download and install (Windows, MacOS) from: https://openclawcli.vercel.app/

Verify installation:

```bash

openclawcli --version
text

### Technical Analysis

The skill instructs users to download and install a required executable from a mutable Vercel-hosted website. It does not specify an exact package version, immutable artifact URL, cryptographic checksum, digital signature, trusted package registry, or source repository from which the executable can be independently verified.

The package itself contains only documentation and metadata; it does not include the PhoenixShield or OpenClaw CLI implementation. Consequently, the behavior and provenance of the required executable cannot be audited from this project. Running `openclawcli --version` only confirms that an executable responds under that name and does not establish its authenticity or integrity.

This is an insecure software supply-chain dependency. If the hosting account, domain, deployment pipeline, or distributed installer were compromised, the effective executable delivered to users could change after this skill was reviewed.

### Attack Path

1. An attacker compromises the referenced website, its hosting account, deployment pipeline, or downloadable installer.
2. The attacker replaces the legitimate installer or download target with a modified executable.
3. A user follows the prerequisite in `SKILL.md` and installs the unverified executable.
4. The attacker-controlled executable runs with the permissions of the installing user.
5. If the user grants administrative privileges—plausible for the documented system backup, package-update, and rollback operations—the executable may obtain system-wi
...[truncated 659 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable website-only installation instruction with an official, immutable release artifact URL.
  2. Pin the dependency to an exact version rather than directing users to install an unspecified current release.
  3. Publish SHA-256 or stronger cryptographic hashes for every supported platform and require users or installation logic to verify them before execution.
  4. Digitally sign release artifacts and document signature verification using a stable, independently distributed public key.
  5. Link to the authoritative source repository, release history, security policy, and reproducible build instructions.
  6. Prefer a trusted package registry with publisher verification, provenance attestations, and lockfile or digest support.
  7. Document the minimum permissions required for installation and runtime, and explicitly discourage administrative execution unless a specific operation requires it.
  8. Explain that openclawcli --version is only a functional check and must not be treated as an integrity or authenticity check.
  9. Include or reference an auditable implementation of the documented phoenix-shield commands so that backup encryption, credential handling, command execution, and rollback safety can be independently reviewed.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
Once OpenClaw CLI is installed, this skill enables through the `SKILL.md` skill file.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a backup/update safety tool, but it requires installing an external CLI from a third-party URL that is not explained, pinned, or integrity-verified. This creates a supply-chain risk: users may trust the skill’s safety branding and install unrelated software with broad system-update capabilities, potentially leading to arbitrary code execution or system compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill encourages update, deployment, backup, and rollback operations that can alter packages, services, and system state, but it does not place a clear upfront warning about service disruption, privilege requirements, or the risk of damaging production systems. In an automation context, this omission can lead users to run destructive commands without adequate review, especially because the skill is framed as a safety mechanism.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples include system-wide upgrade commands such as 'apt update && apt upgrade -y' and multi-server rollout operations without a prominent caution about their production impact. Because these examples target package management and fleet updates, users may copy-paste them into privileged environments, causing widespread outages, unintended upgrades, or rollback complexity if health checks are insufficient.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation explicitly asserts 'Secure handling of credentials' as a property of the skill, yet the rest of the file only documents backup, deployment, monitoring, and rollback workflows. This is not just incomplete detail: it is an affirmative security claim unsupported by any described capability, controls, or configuration related to credential management.

Content

No source excerpt is available for this finding.