ClawHub
Back to skill

Security audit

Keychains.dev

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate-looking credential proxy, but it gives a third-party service and globally installed CLI broad ongoing authority over authenticated API requests.

Review keychains.dev's security, privacy, retention, and audit controls before installing. Avoid using it for regulated or highly sensitive data unless approved by your organization, prefer pinned package versions, avoid global installation where possible, and verify requested API scopes before approving provider access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding
Unpinned Third-Party Packages and Global CLI Installation Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:68-71`, and `SKILL.md:91-94` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:6`: ```yaml metadata: {"openclaw": {"emoji": "🔐", "homepage": "https://keychains.dev", "requires": {"bins": ["keychains"]}, "install": [{"id": "npm", "kind": "node", "package": "keychains@latest", "global": true, "bins": ["keychains"], "label": "Install Keychains CLI (npm)"}]}} ``` `SKILL.md:68-71`: ```markdown For TypeScript/Node.js agents, `@keychains/machine-sdk` provides `keychainsFetch()` — a drop-in `fetch()` replacement with the same automatic registration and credential handling as the CLI. ``` npm install @keychains/machine-sdk ``` ``` `SKILL.md:91-94`: ```markdown | SDK | Install | Description | |-----|---------|-------------| | [Python SDK](https://pypi.org/project/keychains/) | `pip install keychains` | Drop-in `requests` replacement. `keychains.get()`, `keychains.post()`, `keychains.Session()`. | | [Client SDK](https://www.npmjs.com/package/@keychains/client-sdk) | `npm install @keychains/client-sdk` | TypeScript SDK for delegated environments (VMs, cloud functions). | ``` ### Technical Analysis The primary installation configuration resolves `keychains@latest`, while the documented Node.js and Python SDK installation commands omit versions entirely. These mutable dependency specifications allow the installed code to differ from the code that was reviewed. The primary CLI is also configured for global installation. If a malicious package version is resolved, its lifecycle scripts or runtime code may execute with the privileges of the user performing the installation. A global installation also increases exposure because the resulting executable remains available to unrelated sessions and projects. This is particularly sensitive because the installed components mediate authenticated API re ...[truncated 2004 chars]
Remediation
## Remediation Suggestions 1. Replace `keychains@latest` with a reviewed, exact version such as `keychains@X.Y.Z`. 2. Pin exact versions for `@keychains/machine-sdk`, `@keychains/client-sdk`, and the Python `keychains` package. 3. Use lockfiles and registry-supported integrity hashes to ensure reproducible dependency resolution. 4. Avoid global installation where possible. Prefer a project-local dependency invoked through a controlled package script or an isolated environment. 5. Do not run package installation with administrator or root privileges. 6. Review package lifecycle scripts before installation and disable them where operationally feasible. 7. Verify package publisher identity, provenance attestations, signatures, and registry source. 8. Add automated dependency scanning and require manual security review before updating pinned versions. 9. Run the proxy client with restricted filesystem and network permissions, limiting outbound traffic to the documented proxy and approved API destinations. 10. Present the user with the destination, HTTP method, requested authorization scope, and consequential action before approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
```

```typescript
import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
```

```typescript
import { keychainsFetch, KeychainsError } from '@keychains/machine-sdk';

try {
  const res = await keychainsFetch('https://api.github.com/user/repos', {
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic usage:
```
keychains curl https://api.github.com/user/repos \
  -H "Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples encourage sending requests containing potentially sensitive headers, bodies, and query parameters through keychains.dev without an immediate, prominent warning in the example section that all request content is proxied via a third-party service. While the document discloses proxying later, users may copy-paste the examples before understanding that API payload data—not just credentials—will transit and potentially be retained or logged by an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
- "List GitHub repos: `keychains curl https://api.github.com/user/repos -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`"
- "Send Slack message: `keychains curl https://slack.com/api/chat.postMessage -X POST -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}' -H 'Content-Type: application/json' -d '{\"channel\":\"#general\",\"text\":\"Hello!\"}'`"
- "List Stripe customers: `keychains curl https://api.stripe.com/v1/customers?limit=5 -H 'Authorization: Bearer {{STRIPE_SECRET_KEY}}'`"
- "Read Gmail: `keychains curl 'https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=10' -H 'Authorization: Bearer {{OAUTH2_ACCESS_TOKEN}}'`"

## How It Works
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.