Openclaw Plugin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 0.2.10

Overview

The skill has a coherent sync purpose, but it automatically moves sensitive OpenClaw workspace data to and from GitHub with limited review controls and mutable npm execution.

Install only if you intentionally want OpenClaw skills, memory, and settings synchronized through a GitHub repository. Use a private, least-privilege repository, disable autoSync until you have reviewed the generated .any-sync.json mappings, avoid syncing secrets or private memory, and prefer a pinned, reviewed version of the any-sync CLI instead of unversioned npx execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: package.json:21
• Finding: Unpinned and inconsistently named npm dependencies allow mutable third-party code execution<![CDATA[ ## Vulnerability Details **File Location**: `package.json:21-23`; `skills/start/SKILL.md:18-20,42-55`; `skills/pull/SKILL.md:20-24`; `skills/push/SKILL.md:22-24,36-40`; `skills/status/SKILL.md:20-24`; `skills/reset/SKILL.md:26-30` **Vulnerability Type**: Supply-chain compromise through an unpinned dependency and unversioned `npx` execution **Risk Level**: High ### Vulnerable Code `package.json:21-23`: ```json "dependencies": { "@any-sync/cli": "*" } ``` `skills/start/SKILL.md:18-20`: ```bash npx any-sync auth ``` `skills/start/SKILL.md:42-55`: ```bash npx any-sync init "$HOME/.any-sync.json" "<owner/repo>" "<branch>" --preset openclaw ``` ```bash npx any-sync pull "$HOME/.any-sync.json" ".any-sync.lock" ``` `skills/pull/SKILL.md:20-24`: ```bash npx any-sync pull "<config-path>" ".any-sync.lock" ``` `skills/push/SKILL.md:22-24,36-40`: ```bash npx any-sync status "<config-path>" ".any-sync.lock" ``` ```bash npx any-sync push "<config-path>" ".any-sync.lock" ``` `skills/status/SKILL.md:20-24`: ```bash npx any-sync status "<config-path>" ".any-sync.lock" ``` `skills/reset/SKILL.md:26-30`: ```bash npx any-sync reset "<config-path>" ".any-sync.lock" ``` ### Technical Analysis The declared runtime dependency uses the wildcard version `"*"`, allowing any available version of `@any-sync/cli` to satisfy installation. This prevents reproducible dependency resolution and permits a newly published or compromised release to enter the environment without a source-code change. The skill instructions also execute the differently named `any-sync` package through unversioned `npx` commands. When a matching executable is not installed locally, `npx` may download package code from the configured npm registry at execution time. This creates a remote, mutable code-execution path that is not constrained to the dependency reviewed with this project. The mismatch between `@any-sync/cli` and `any-sync` further increases the risk that the instructions reso ...[truncated 1558 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the wildcard with an exact, audited dependency version: ```json "@any-sync/cli": "X.Y.Z" ``` 2. Commit a package-manager lockfile with integrity hashes and require deterministic, frozen-lockfile installation in release workflows. 3. Align all instructions with the actual declared package name and installed executable. 4. Invoke only the locally installed binary. If `npx` must be used, use `npx --no-install` so it fails instead of downloading unknown code. 5. Pin the package version explicitly in every command if remote resolution cannot be eliminated. 6. Review package provenance, registry ownership, lifecycle scripts, and release signatures before updating. 7. Use automated dependency review and alerting, but do not allow automated updates to execute before review and testing. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: src/index.ts:26
• Finding: Automatic remote synchronization can overwrite persistent Agent instructions and memory without review<![CDATA[ ## Vulnerability Details **File Location**: `src/index.ts:26-46`; `hooks/session-pull/handler.ts:9-18`; `skills/start/SKILL.md:35-55` **Vulnerability Type**: Remote instruction injection and persistent memory poisoning **Risk Level**: High ### Vulnerable Code `src/index.ts:26-46`: ```ts const autoSync = api.pluginConfig?.autoSync !== false; if (autoSync) { api.registerHook('session_start', { handler: async () => { try { const result = autoPull(); const count = result?.pulled?.length ?? 0; if (count > 0) { api.logger.info(`Any Sync: auto-pulled ${count} file(s) from GitHub`); } } catch { // Silent failure } }, }); api.registerHook('session_end', { handler: async () => { try { const result = autoPush(); ``` `hooks/session-pull/handler.ts:9-18`: ```ts const handler = async (event: { type: string; messages: string[] }) => { try { const result = autoPull(); const pullCount = result?.pulled?.length ?? 0; if (pullCount > 0) { event.messages.push(`Any Sync: auto-pulled ${pullCount} file(s) from GitHub.`); } } catch { // Silent failure — don't block session start } }; ``` `skills/start/SKILL.md:35-55`: ```md ### 3. Create Config Ask the user which items to sync (default: all three): - Skills (`~/.openclaw/workspace/skills`) - Memory (`~/.openclaw/workspace/memory`) - Config files (`AGENTS.md`, `SOUL.md`, `USER.md`, `TOOLS.md`, `IDENTITY.md`) Then run the init command with the OpenClaw preset: ```bash npx any-sync init "$HOME/.any-sync.json" "<owner/repo>" "<branch>" --preset openclaw ``` Use `main` as the default branch unless the user specifies otherwise. The init command respects `OPENCLAW_WORKSPACE` and `OPENCLAW_PROFILE` environment variables for custom workspace paths. ### 4. First Pull Run the first pull to download existing files: ```bash npx any-sync pull "$HOME/.any-sync.json" ".any-sync.lock" ``` ``` ### ...[truncated 2312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make automatic pull disabled by default and require explicit informed consent. 2. Fetch remote changes into a staging directory rather than writing directly into the active workspace. 3. Display a complete diff and require confirmation before applying changes to skills, memory, or instruction-bearing files. 4. Treat `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `IDENTITY.md`, skills, and memory as high-risk content requiring separate approval. 5. Pin pulls to a reviewed commit hash or release and verify signed commits from trusted identities. 6. Maintain an allowlist of synchronized paths and exclude executable or instruction-bearing files by default. 7. Validate downloaded paths to ensure the underlying CLI cannot write outside configured synchronization roots. 8. Preserve a local rollback snapshot and record the source commit for every applied synchronization. 9. Remove the duplicate standalone pull hook or ensure it applies the same `autoSync`, verification, and approval policies as the plugin hook. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:26
• Finding: Default automatic push can upload sensitive workspace data without per-operation consent<![CDATA[ ## Vulnerability Details **File Location**: `src/index.ts:26-28,43-53`; `hooks/session-push/handler.ts:9-18`; `skills/start/SKILL.md:35-44`; `skills/push/SKILL.md:27-40` **Vulnerability Type**: Unintended disclosure through automatic synchronization **Risk Level**: Medium ### Vulnerable Code `src/index.ts:26-28,43-53`: ```ts const autoSync = api.pluginConfig?.autoSync !== false; if (autoSync) { ``` ```ts api.registerHook('session_end', { handler: async () => { try { const result = autoPush(); const count = result?.pushed?.length ?? 0; if (count > 0) { api.logger.info(`Any Sync: auto-pushed ${count} file(s) to GitHub`); } } catch { // Silent failure } }, }); ``` `hooks/session-push/handler.ts:9-18`: ```ts const handler = async (event: { type: string; messages: string[] }) => { try { const result = autoPush(); const pushCount = result?.pushed?.length ?? 0; if (pushCount > 0) { event.messages.push(`Any Sync: auto-pushed ${pushCount} file(s) to GitHub.`); } } catch { // Silent failure — don't block session end } }; ``` `skills/start/SKILL.md:35-44`: ```md ### 3. Create Config Ask the user which items to sync (default: all three): - Skills (`~/.openclaw/workspace/skills`) - Memory (`~/.openclaw/workspace/memory`) - Config files (`AGENTS.md`, `SOUL.md`, `USER.md`, `TOOLS.md`, `IDENTITY.md`) Then run the init command with the OpenClaw preset: ```bash npx any-sync init "$HOME/.any-sync.json" "<owner/repo>" "<branch>" --preset openclaw ``` ``` By contrast, the manual push workflow in `skills/push/SKILL.md:27-40` requires confirmation: ```md Show the user which files have changed (modified or new) across all mappings. ### 3. Confirm Push Ask the user to confirm before pushing. Show: - Which files will be pushed - Which branch they will be pushed to - Which repo they will be pushed to ### 4. Run Push If confirmed: ```bash npx any-sync push "<config-path>" ".any ...[truncated 2279 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set automatic push to disabled by default and require explicit opt-in. 2. Before enabling auto-push, show the exact repository, branch, visibility, collaborators, and synchronized paths. 3. Enforce the `autoSync` setting consistently in both the plugin hook and standalone hook. 4. Separate pull and push controls so users can enable one without implicitly enabling the other. 5. Require confirmation when new files, instruction files, memory, or potentially sensitive files are first uploaded. 6. Add explicit path allowlists and exclusion patterns for secrets, credentials, environment files, logs, and private memory. 7. Run secret scanning before upload and block a push when likely credentials are found. 8. Warn or refuse to synchronize sensitive default categories to a public repository. 9. Record successful and failed synchronization operations in a security-conscious audit log rather than silently suppressing all errors. 10. Provide guidance for repository-history cleanup and credential rotation if accidental disclosure occurs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/start/SKILL.md:35
• Finding: Setup workflow does not encode the user's selected synchronization categories<![CDATA[ ## Vulnerability Details **File Location**: `skills/start/SKILL.md:35-45` **Vulnerability Type**: Consent and configuration mismatch in synchronization setup **Risk Level**: Medium ### Vulnerable Code `skills/start/SKILL.md:35-45`: ```md ### 3. Create Config Ask the user which items to sync (default: all three): - Skills (`~/.openclaw/workspace/skills`) - Memory (`~/.openclaw/workspace/memory`) - Config files (`AGENTS.md`, `SOUL.md`, `USER.md`, `TOOLS.md`, `IDENTITY.md`) Then run the init command with the OpenClaw preset: ```bash npx any-sync init "$HOME/.any-sync.json" "<owner/repo>" "<branch>" --preset openclaw ``` ``` ### Technical Analysis The setup instructions ask the user to choose which categories should be synchronized, but the documented initialization command does not include any argument representing those choices. It always invokes the same `--preset openclaw` command. Within the audited project, no subsequent step edits or verifies the generated configuration according to the user's selection. Therefore, the workflow does not demonstrate that deselected memory or configuration files are excluded. This creates a discrepancy between the consent presented to the user and the configuration actually generated. If the preset includes all listed OpenClaw mappings, a user who deselects memory or configuration may still have those files included in later pull and push operations. ### Attack Path 1. During setup, the user states that memory or configuration files must not be synchronized. 2. The Agent follows the documented workflow and runs the same OpenClaw preset command regardless of that selection. 3. No explicit exclusion or mapping argument is supplied, and no generated configuration verification is required. 4. The resulting configuration may retain mappings for the category that the user intended to exclude. 5. A later automatic or manual push uploads those files to the configured repository. 6. Repository users obtain content ...[truncated 716 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Translate every user choice into explicit CLI mapping or exclusion arguments. 2. Avoid a broad preset when the user has deselected any default category. 3. After initialization, read and display the generated configuration and verify that it exactly matches the approved categories. 4. Show the resolved absolute paths, repository, and branch before enabling synchronization. 5. Require separate consent for skills, memory, and Agent configuration rather than treating them as one setting. 6. Abort setup if the installed CLI cannot represent the requested exclusions. 7. Add automated tests covering every combination of selected categories and assert that excluded paths are absent. 8. Keep automatic synchronization disabled until the generated configuration has been reviewed and accepted. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The hook description states that workspace files are automatically pulled from GitHub at session start and 'runs silently,' but it does not clearly warn users that local files may be modified immediately on startup. In a sync skill, this is security-relevant because remote repository contents can change code, prompts, hooks, memory, or settings without an explicit per-session confirmation, increasing the risk of unnoticed tampering or unexpected state changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The hook explicitly states it will automatically push workspace changes to GitHub at session end and that it runs silently, meaning users may not realize local changes, memory, settings, or other sensitive workspace artifacts are being exfiltrated to a remote repository. In the context of a cross-device sync skill, automatic background sync is expected, but doing it without clear notice, consent, or per-push confirmation increases the risk of unintentionally uploading secrets, proprietary code, or private notes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest states that the skill performs cross-device sync of workspace data via GitHub, including skills, memory, and settings, but it does not warn that this may transmit potentially sensitive local data to a remote third-party service. Because the feature may also operate automatically, users may unknowingly expose secrets, personal context, or internal configuration to a repository, making the risk materially higher in this skill context.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest advertises auto-sync on session start/end but does not define clear activation constraints, scope, or consent boundaries. In a skill that syncs workspace contents to GitHub, vague automatic triggering increases the risk of unintentional transmission of sensitive skills, memory, or settings without the user understanding exactly when it occurs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill executes `npx any-sync` without pinning an exact package version, so each run may fetch and execute whatever version is currently published under that name. In a sync skill that handles workspace files, this creates a meaningful supply-chain risk: a compromised maintainer account, malicious new release, dependency hijack, or typo-squatted resolution path could lead to arbitrary code execution in the user's environment and access to synced data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill invokes `npx any-sync` without pinning an exact package version or otherwise constraining the source. That means execution depends on whatever version is currently resolved from the registry or local environment, creating a supply-chain/code-execution risk if the package is updated maliciously, compromised, or typo-squatted.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The push step again runs `npx any-sync` without a pinned version, so the skill may fetch and execute unreviewed code at the moment it performs a sensitive operation involving workspace contents and GitHub synchronization. In this context, compromise could lead to arbitrary code execution, credential access, or unauthorized exfiltration/modification of synced data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute `npx any-sync` without pinning a specific package version. `npx` may fetch and run the latest published package from the registry at execution time, creating a supply-chain risk if the package is compromised, replaced, or updated with malicious behavior. Because this skill performs a reset operation touching files in the user's home/current directory, the runtime package would execute with access to local workspace state.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs the agent to execute `npx any-sync auth` without pinning a specific package version. This allows whatever version is currently published under that name to be fetched and run at execution time, creating a supply-chain risk where a compromised or malicious release could execute arbitrary code in the user's environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ask the user for their sync repo in `owner/repo` format. This is the GitHub repository where their OpenClaw workspace files will be stored.

If they don't have one yet, suggest they create a new private repo on GitHub first.

### 3. Create Config

• Confidence: 80% confidence
• Finding: The skill is explicitly designed to persist and synchronize OpenClaw workspace data across devices, including skills, memory, and configuration documents. This is intentional functionality rather than overtly malicious behavior, but it still increases security exposure because sensitive agent state is stored in a remote repository and later reintroduced into local sessions, potentially propagating secrets or unsafe content across environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill omits an explicit warning that setup will write `$HOME/.any-sync.json` and pull repository contents into the local OpenClaw workspace. That lack of disclosure can lead users to authorize operations affecting sensitive local files and persistent configuration without fully understanding the side effects, which is especially risky for sync features touching skills, memory, and agent config files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The init step uses `npx any-sync init` with no version pin, so the setup path may download and execute an unexpected package version when creating the sync configuration. Because this command writes config and defines mappings for sensitive workspace content, a hostile package version could abuse that trust to exfiltrate data or alter configuration.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The first pull step runs `npx any-sync pull` without a pinned version, again exposing the user to runtime package substitution or malicious upstream updates. In this context the command both executes code and pulls remote content into the local workspace, increasing the blast radius if the fetched package is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill invokes `npx any-sync` without pinning an exact package version, which allows execution of whatever version is currently resolved from npm. If the package is updated maliciously, compromised upstream, or subject to dependency confusion or account takeover, running the skill could execute attacker-controlled code on the user's machine with the agent's privileges.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test": "node --test ../cli/test/*.test.js"
  },
  "dependencies": {
    "@any-sync/cli": "*"
  },
  "keywords": ["openclaw", "sync", "skills", "memory", "github", "workspace"],
  "license": "MIT",

• Confidence: 97% confidence
• Finding: The dependency "@any-sync/cli" is specified with a wildcard version, allowing any published version to be installed. This creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be pulled into a sync plugin that handles workspace data and GitHub integration, increasing the blast radius beyond a typical low-risk package.

Static analysis

No suspicious patterns detected.