Openclaw Plugin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 0.2.10

Overview

The skill has a coherent sync purpose, but it automatically moves sensitive OpenClaw workspace data to and from GitHub with limited review controls and mutable npm execution.

Install only if you intentionally want OpenClaw skills, memory, and settings synchronized through a GitHub repository. Use a private, least-privilege repository, disable autoSync until you have reviewed the generated .any-sync.json mappings, avoid syncing secrets or private memory, and prefer a pinned, reviewed version of the any-sync CLI instead of unversioned npx execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: package.json:21

Finding

Unpinned and inconsistently named npm dependencies allow mutable third-party code execution

Content

View full analysis

" "" --preset openclaw ``` ```bash npx any-sync pull "$HOME/.any-sync.json" ".any-sync.lock" ``` `skills/pull/SKILL.md:20-24`: ```bash npx any-sync pull "" ".any-sync.lock" ``` `skills/push/SKILL.md:22-24,36-40`: ```bash npx any-sync status "" ".any-sync.lock" ``` ```bash npx any-sync push "" ".any-sync.lock" ``` `skills/status/SKILL.md:20-24`: ```bash npx any-sync status "" ".any-sync.lock" ``` `skills/reset/SKILL.md:26-30`: ```bash npx any-sync reset "" ".any-sync.lock" ``` ### Technical Analysis The declared runtime dependency uses the wildcard version `"*"`, allowing any available version of `@any-sync/cli` to satisfy installation. This prevents reproducible dependency resolution and permits a newly published or compromised release to enter the environment without a source-code change. The skill instructions also execute the differently named `any-sync` package through unversioned `npx` commands. When a matching executable is not installed locally, `npx` may download package code from the configured npm registry at execution time. This creates a remote, mutable code-execution path that is not constrained to the dependency reviewed with this project. The mismatch between `@any-sync/cli` and `any-sync` further increases the risk that the instructions reso ...[truncated 1558 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: src/index.ts:26

Finding

Automatic remote synchronization can overwrite persistent Agent instructions and memory without review

Content

View full analysis

{ try { const result = autoPull(); const count = result?.pulled?.length ?? 0; if (count > 0) { api.logger.info(`Any Sync: auto-pulled ${count} file(s) from GitHub`); } } catch { // Silent failure } }, }); api.registerHook('session_end', { handler: async () => { try { const result = autoPush(); ``` `hooks/session-pull/handler.ts:9-18`: ```ts const handler = async (event: { type: string; messages: string[] }) => { try { const result = autoPull(); const pullCount = result?.pulled?.length ?? 0; if (pullCount > 0) { event.messages.push(`Any Sync: auto-pulled ${pullCount} file(s) from GitHub.`); } } catch { // Silent failure — don't block session start } }; ``` `skills/start/SKILL.md:35-55`: ```md ### 3. Create Config Ask the user which items to sync (default: all three): - Skills (`~/.openclaw/workspace/skills`) - Memory (`~/.openclaw/workspace/memory`) - Config files (`AGENTS.md`, `SOUL.md`, `USER.md`, `TOOLS.md`, `IDENTITY.md`) Then run the init command with the OpenClaw preset: ```bash npx any-sync init "$HOME/.any-sync.json" "" "" --preset openclaw ``` Use `main` as the default branch unless the user specifies otherwise. The init command respects `OPENCLAW_WORKSPACE` and `OPENCLAW_PROFILE` environment variables for custom workspace paths. ### 4. First Pull Run the first pull to download existing files: ```bash npx any-sync pull "$HOME/.any-sync.json" ".any-sync.lock" ``` ``` ### ...[truncated 2312 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:26

Finding

Default automatic push can upload sensitive workspace data without per-operation consent

Content

View full analysis

{ try { const result = autoPush(); const count = result?.pushed?.length ?? 0; if (count > 0) { api.logger.info(`Any Sync: auto-pushed ${count} file(s) to GitHub`); } } catch { // Silent failure } }, }); ``` `hooks/session-push/handler.ts:9-18`: ```ts const handler = async (event: { type: string; messages: string[] }) => { try { const result = autoPush(); const pushCount = result?.pushed?.length ?? 0; if (pushCount > 0) { event.messages.push(`Any Sync: auto-pushed ${pushCount} file(s) to GitHub.`); } } catch { // Silent failure — don't block session end } }; ``` `skills/start/SKILL.md:35-44`: ```md ### 3. Create Config Ask the user which items to sync (default: all three): - Skills (`~/.openclaw/workspace/skills`) - Memory (`~/.openclaw/workspace/memory`) - Config files (`AGENTS.md`, `SOUL.md`, `USER.md`, `TOOLS.md`, `IDENTITY.md`) Then run the init command with the OpenClaw preset: ```bash npx any-sync init "$HOME/.any-sync.json" "" "" --preset openclaw ``` ``` By contrast, the manual push workflow in `skills/push/SKILL.md:27-40` requires confirmation: ```md Show the user which files have changed (modified or new) across all mappings. ### 3. Confirm Push Ask the user to confirm before pushing. Show: - Which files will be pushed - Which branch they will be pushed to - Which repo they will be pushed to ### 4. Run Push If confirmed: ```bash npx any-sync push "" ".any ...[truncated 2279 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/start/SKILL.md:35

Finding

Setup workflow does not encode the user's selected synchronization categories

Content

View full analysis

" "" --preset openclaw ``` ``` ### Technical Analysis The setup instructions ask the user to choose which categories should be synchronized, but the documented initialization command does not include any argument representing those choices. It always invokes the same `--preset openclaw` command. Within the audited project, no subsequent step edits or verifies the generated configuration according to the user's selection. Therefore, the workflow does not demonstrate that deselected memory or configuration files are excluded. This creates a discrepancy between the consent presented to the user and the configuration actually generated. If the preset includes all listed OpenClaw mappings, a user who deselects memory or configuration may still have those files included in later pull and push operations. ### Attack Path 1. During setup, the user states that memory or configuration files must not be synchronized. 2. The Agent follows the documented workflow and runs the same OpenClaw preset command regardless of that selection. 3. No explicit exclusion or mapping argument is supplied, and no generated configuration verification is required. 4. The resulting configuration may retain mappings for the category that the user intended to exclude. 5. A later automatic or manual push uploads those files to the configured repository. 6. Repository users obtain content ...[truncated 716 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hook description states that workspace files are automatically pulled from GitHub at session start and 'runs silently,' but it does not clearly warn users that local files may be modified immediately on startup. In a sync skill, this is security-relevant because remote repository contents can change code, prompts, hooks, memory, or settings without an explicit per-session confirmation, increasing the risk of unnoticed tampering or unexpected state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hook explicitly states it will automatically push workspace changes to GitHub at session end and that it runs silently, meaning users may not realize local changes, memory, settings, or other sensitive workspace artifacts are being exfiltrated to a remote repository. In the context of a cross-device sync skill, automatic background sync is expected, but doing it without clear notice, consent, or per-push confirmation increases the risk of unintentionally uploading secrets, proprietary code, or private notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest states that the skill performs cross-device sync of workspace data via GitHub, including skills, memory, and settings, but it does not warn that this may transmit potentially sensitive local data to a remote third-party service. Because the feature may also operate automatically, users may unknowingly expose secrets, personal context, or internal configuration to a repository, making the risk materially higher in this skill context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest advertises auto-sync on session start/end but does not define clear activation constraints, scope, or consent boundaries. In a skill that syncs workspace contents to GitHub, vague automatic triggering increases the risk of unintentional transmission of sensitive skills, memory, or settings without the user understanding exactly when it occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill executes npx any-sync without pinning an exact package version, so each run may fetch and execute whatever version is currently published under that name. In a sync skill that handles workspace files, this creates a meaningful supply-chain risk: a compromised maintainer account, malicious new release, dependency hijack, or typo-squatted resolution path could lead to arbitrary code execution in the user's environment and access to synced data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill invokes npx any-sync without pinning an exact package version or otherwise constraining the source. That means execution depends on whatever version is currently resolved from the registry or local environment, creating a supply-chain/code-execution risk if the package is updated maliciously, compromised, or typo-squatted.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The push step again runs npx any-sync without a pinned version, so the skill may fetch and execute unreviewed code at the moment it performs a sensitive operation involving workspace contents and GitHub synchronization. In this context, compromise could lead to arbitrary code execution, credential access, or unauthorized exfiltration/modification of synced data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs the agent to execute npx any-sync without pinning a specific package version. npx may fetch and run the latest published package from the registry at execution time, creating a supply-chain risk if the package is compromised, replaced, or updated with malicious behavior. Because this skill performs a reset operation touching files in the user's home/current directory, the runtime package would execute with access to local workspace state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute npx any-sync auth without pinning a specific package version. This allows whatever version is currently published under that name to be fetched and run at execution time, creating a supply-chain risk where a compromised or malicious release could execute arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill is explicitly designed to persist and synchronize OpenClaw workspace data across devices, including skills, memory, and configuration documents. This is intentional functionality rather than overtly malicious behavior, but it still increases security exposure because sensitive agent state is stored in a remote repository and later reintroduced into local sessions, potentially propagating secrets or unsafe content across environments.

Content

Scanner excerpt · skills/start/SKILL.md (reported line 33)May include surrounding context.

md

Ask the user for their sync repo in `owner/repo` format. This is the GitHub repository where their OpenClaw workspace files will be stored.

If they don't have one yet, suggest they create a new private repo on GitHub first.

### 3. Create Config

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill omits an explicit warning that setup will write $HOME/.any-sync.json and pull repository contents into the local OpenClaw workspace. That lack of disclosure can lead users to authorize operations affecting sensitive local files and persistent configuration without fully understanding the side effects, which is especially risky for sync features touching skills, memory, and agent config files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The init step uses npx any-sync init with no version pin, so the setup path may download and execute an unexpected package version when creating the sync configuration. Because this command writes config and defines mappings for sensitive workspace content, a hostile package version could abuse that trust to exfiltrate data or alter configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The first pull step runs npx any-sync pull without a pinned version, again exposing the user to runtime package substitution or malicious upstream updates. In this context the command both executes code and pulls remote content into the local workspace, increasing the blast radius if the fetched package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill invokes npx any-sync without pinning an exact package version, which allows execution of whatever version is currently resolved from npm. If the package is updated maliciously, compromised upstream, or subject to dependency confusion or account takeover, running the skill could execute attacker-controlled code on the user's machine with the agent's privileges.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency "@any-sync/cli" is specified with a wildcard version, allowing any published version to be installed. This creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be pulled into a sync plugin that handles workspace data and GitHub integration, increasing the blast radius beyond a typical low-risk package.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"test": "node --test ../cli/test/*.test.js"
  },
  "dependencies": {
    "@any-sync/cli": "*"
  },
  "keywords": ["openclaw", "sync", "skills", "memory", "github", "workspace"],
  "license": "MIT",