Paperclip Orchestration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 0.1.0

Overview

The skill is for a real Paperclip/OpenClaw integration, but it grants and persists sensitive access with weak scoping and unsafe approval/install steps.

Review this skill carefully before installing. Only use it with a Paperclip deployment you trust, avoid sending your primary OpenClaw gateway token to arbitrary URLs, avoid granting operator.admin unless specifically needed, approve device pairings by verified ID rather than latest, and inspect any Paperclip skill before installing it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:50

Finding

Primary OpenClaw Gateway Credential Disclosed to an Unrestricted Remote Endpoint

Content

View full analysis

" }, "waitTimeoutMs": 120000, "sessionKeyStrategy": "issue", "role": "operator", "scopes": ["operator.admin"] } } ``` ```text - Read the token from `~/.openclaw/openclaw.json -> gateway.auth.token`. - Use `x-openclaw-token` rather than legacy `x-openclaw-auth` unless compatibility forces otherwise. ``` ### Technical Analysis The Skill directs the agent to read the primary OpenClaw gateway authentication token from a local configuration file and include it in an onboarding payload sent to a Paperclip endpoint. The Paperclip base URL is selected according to reachability and is not restricted by a trusted-domain allowlist, certificate pinning, or an equivalent destination trust policy. A health check confirms availability but does not establish that the endpoint is authorized to receive a reusable gateway credential. The workflow also does not require creation of a temporary, audience-bound onboarding credential. Consequently, a malicious, impersonated, or compromised Paperclip server could retain and reuse the gateway token. This behavior exceeds minimum privilege because connectivity onboarding can be implemented with a dedicated, short-lived token rather than disclosure of the primary gateway credential. ### Attack Path 1. An attacker supplies or causes the user to use an attacker-controlled Paperclip base URL. 2. The malicious endpoint returns valid-looking health and onboarding responses. 3. Foll ...[truncated 938 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:55

Finding

Administrative Scope Is Requested by Default Without Demonstrated Need

Content

View full analysis

" }, "waitTimeoutMs": 120000, "sessionKeyStrategy": "issue", "role": "operator", "scopes": ["operator.admin"] ``` ### Technical Analysis The prescribed onboarding payload requests the `operator.admin` scope by default. The Skill's stated functionality includes onboarding, connectivity checks, agent orchestration, task assignment, and status monitoring, but it does not establish that every operation requires unrestricted administrative authority. Assigning administrative scope during the initial trust relationship violates least privilege. It also amplifies the impact of credential disclosure, Paperclip compromise, configuration mistakes, or unauthorized device pairing. No staged authorization model, per-operation scope selection, or separate confirmation for privileged administration is specified. ### Attack Path 1. The agent submits the documented onboarding payload with `operator.admin`. 2. Paperclip or the associated integration receives administrative authorization. 3. The Paperclip service, its credentials, or an approved device is compromised. 4. The attacker reuses the privileged integration context or credential. 5. The attacker performs administrative actions beyond ordinary agent and task orchestration. ### Impact Assessment An attacker who compromises the integration may obtain operator-administrator capabilities instead of narrowly scoped task-management access. Depending on OpenClaw's enforcement model, this could permit management of agents, configuration, devices, authorization state, or other privileged gateway resources. It substantially increases the blast radius of every other authentication or pairing failure in the workflow. ]]>

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Remote Onboarding Instructions Can Select Unreviewed Skills for Installation

Content

View full analysis

/api/health`. 2. Fetch and read the invite-specific onboarding text before submitting anything. 3. Determine the OpenClaw gateway URL that Paperclip can reach. 4. Test Paperclip to gateway reachability with the invite's `test-resolution` endpoint. 5. Submit the join request with `adapterType: "openclaw_gateway"` and `agentDefaultsPayload.headers["x-openclaw-token"]`. 6. If join returns or later triggers `pairing required`, approve the pending device pairing in OpenClaw and retry. 7. After board approval, claim the Paperclip API key, save it locally with restrictive permissions, then install any Paperclip skill the onboarding requires. ``` ### Technical Analysis The Skill requires the agent to retrieve invite-specific onboarding text from a remote Paperclip deployment and then install any Paperclip Skill required by that text. The remote response can therefore influence which additional component is installed after this Skill has been reviewed. The workflow does not require an allowlisted package identity, trusted registry, immutable version, cryptographic digest, signature verification, source inspection, or explicit approval of the retrieved Skill. A compromised or malicious Paperclip deployment could alter the effective payload by directing the agent to an attacker-controlled Skill. Although the text does not provide the exact installation command, it explicitly establishes remote onboarding content as an installation authority. This creates both a remote-payload and software supply-chain risk. ### Attack Path 1. An attacker controls or compromises the Paperclip onboarding endpoint. 2. The agent retrieves invite-specific onboarding instructions from th ...[truncated 874 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:145

Finding

Approving the Latest Pairing Request Can Authorize an Attacker-Controlled Device

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: paperclip-orchestration
description: Connect OpenClaw Gateway to Paperclip, diagnose onboarding and reachability failures, claim and store Paperclip API keys, install the Paperclip skill, and orchestrate Paperclip agents and tasks. Use when the user wants to join a Paperclip org, fix Paperclip connectivity, create or manage Paperclip agents, assign work through Paperclip, or monitor Paperclip agent status.
---

# Paperclip orchestration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs saving a claimed Paperclip API key response to disk for future reuse, which creates a persistent local secret without requiring explicit user consent or minimizing what is stored. Even with restrictive file permissions, storing the full claim response increases exposure if the workstation, backup system, logs, or workspace directory is later accessed by another user or process.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

2. Wait for board approval.
3. Claim the API key with the one-time claim secret.
4. Save the full claim response to `~/.openclaw/workspace/paperclip-claimed-api-key.json`.
5. `chmod 600 ~/.openclaw/workspace/paperclip-claimed-api-key.json`.
6. Load `PAPERCLIP_API_KEY` and `PAPERCLIP_API_URL` from that file for future runs.

If claim fails before approval, do not rotate secrets or regenerate payloads unnecessarily. Wait for approval and retry once.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill directs reading a gateway auth token from a local secrets file and submitting it in onboarding without an explicit user-facing notice that a sensitive credential will be accessed and reused. In an agentic workflow, silently harvesting local credentials can violate user expectations and expands the blast radius if the wrong token is transmitted to an untrusted or misconfigured Paperclip endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.