clawrent-testing

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

When the skill runs, paid approvals from Clawrent can grant Telegram pairing access without a separate per-code confirmation step.

Why it was flagged

The script converts remote Clawrent approval records into local OpenClaw Telegram pairing approvals. This is disclosed and purpose-aligned, but it is still a high-impact automated action.

Skill content

approvals="$(fetch_by_status approved)" ... if openclaw pairing approve telegram "$code" --notify; then

Recommendation

Install only if you intend Clawrent to automate Telegram pairing approvals, and monitor the token, approval records, and execution logs.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

One expired rental can revoke unrelated or active Telegram access entries and disrupt the user's OpenClaw access controls.

Why it was flagged

For expired rentals, the script overwrites the entire persistent Telegram allowlist file with an empty list instead of removing only the expired rental's access.

Skill content

ALLOW_FILE="${CLAWRENT_ALLOW_FILE:-$HOME/.openclaw/credentials/telegram-allowFrom.json}" ... clear_allowlist() { ... echo "[]" > "$ALLOW_FILE"; }

Recommendation

Change the cleanup logic to remove only the specific expired renter/code, mark expired records as processed, and back up the allowlist before running.