onionclaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:35 AM UTC
• Version: 2.1.13

Overview

OnionClaw’s dark-web OSINT purpose is mostly disclosed, but it combines Tor setup, broad invocation, unpinned dependency installation, recurring monitoring, and unclear local retention in a way users should review before installing.

Install only if you intentionally need Tor-based dark-web OSINT. Use a virtual environment, review any referenced source repository before running setup scripts, pin dependencies where possible, avoid system-wide Tor changes unless you accept them, and choose output/watch locations carefully because searches and reports may include sensitive leak or corporate data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 46
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip3 install requests[socks] beautifulsoup4 python-dotenv stem

Technical Analysis

The documented setup command installs four Python packages without version constraints, lock-file resolution, or cryptographic hashes. Each installation therefore resolves against the package index's mutable current state rather than a reproducible, reviewed dependency set.

If a package account, release process, distribution artifact, or transitive dependency is compromised, a user following these instructions may install attacker-controlled code. Python packages can execute code during installation through build backends, and malicious package code can also execute when imported by the referenced application scripts.

The project snapshot contains only SKILL.md; the referenced scripts and dependency manifests are absent. Consequently, package usage, transitive dependencies, and any compensating controls cannot be verified.

Attack Path

1. An attacker compromises one of the named packages, its maintainer account, its release infrastructure, or a transitive dependency.
2. The attacker publishes a malicious release that remains compatible with the unconstrained package requirement.
3. A user follows the documented setup procedure and runs the unpinned pip3 install command.
4. pip3 selects and installs the malicious release from the package index.
5. Attacker-controlled code executes during package build/installation or when the package is imported by OnionClaw.
6. The malicious code operates with the privileges of the account running pip3 or the application.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. The affected scope may include files and credentials acce ...[truncated 416 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version.
2. Generate a lock file that also fixes all transitive dependency versions.
3. Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file and pip install --require-hashes.
4. Prefer reviewed binary wheels where appropriate and prevent unexpected source builds.
5. Install dependencies inside a dedicated virtual environment under a nonprivileged account rather than into the system Python environment.
6. Explicitly configure the trusted package index and disallow unreviewed additional indexes.
7. Add automated dependency vulnerability and provenance scanning.
8. Include the referenced source files and dependency manifests in the auditable package so reviewers can verify how each dependency is used.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

python3 {baseDir}/setup.py

— OR — manual setup:

cp {baseDir}/.env.example {baseDir}/.env

Edit {baseDir}/.env — add your LLM key (search + fetch work without one)

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

python3 {baseDir}/setup.py

— OR — manual setup:

cp {baseDir}/.env.example {baseDir}/.env

Edit {baseDir}/.env — add your LLM key (search + fetch work without one)

text

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

# Linux:
sudo apt install tor && sudo systemctl start tor

# macOS:
brew install tor && brew services start tor

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation text is broad enough to trigger on generic investigative requests such as leaked credentials, ransomware, or OSINT tasks, even when the user did not explicitly request Tor or dark-web access. In a high-risk skill that routes traffic through Tor and fetches hidden-service content, overbroad invocation increases the chance of unnecessary use of sensitive capabilities and unexpected handling of potentially illicit or privacy-sensitive material.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

# Linux:
sudo apt install tor && sudo systemctl start tor

# macOS:
brew install tor && brew services start tor

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation promotes recurring watch jobs, daemon polling, and output directories but does not clearly warn that investigation results are persisted to disk, potentially including sensitive leak data, indicators, or queried targets. This can create unintended local data retention, exposure to other users on the host, and forensic artifacts that defeat privacy expectations associated with Tor-based investigations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.