ClawHub
Back to skill

Security audit

Dap

Security checks for vulnerabilities and agentic risk

Overview

This P2P messaging skill is purpose-aligned, but it automatically announces the agent to remote peers and installs an unpinned external plugin, which users should review before installing.

Review this skill carefully before installing. It is designed to communicate with other agents over the network and may reveal your agent ID, availability, and reachable endpoints to bootstrap nodes and discovered peers. Install only if you are comfortable running the external npm plugin and prefer a pinned or verified package version where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned npm Plugin Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8-10; references/install.md:8-14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code in SKILL.md:

yaml
install:
  - kind: node
    package: "@resciencelab/dap"

Vulnerable code in references/install.md:

bash
npm install @resciencelab/dap

Or via OpenClaw:

bash
openclaw plugin install @resciencelab/dap

Technical Analysis

The installation metadata and documentation install @resciencelab/dap without specifying an exact version or package integrity hash. Consequently, the package version resolved at installation time can differ from the version that was originally reviewed.

The executable implementation of the npm package is not included in the audited project, and no lockfile, checksum, signature, or reproducible-build information is provided. The project therefore cannot independently establish what code these commands will install. npm lifecycle scripts may also execute during installation unless explicitly disabled.

This is a supply-chain weakness rather than evidence that the current publisher or package is malicious. The package scope and matching project homepage reduce typo-squatting concerns, but they do not protect against publisher-account compromise, registry compromise, or a malicious future release.

Attack Path

  1. An attacker compromises the npm publisher account, publication token, package namespace, or release workflow for @resciencelab/dap.
  2. The attacker publishes a malicious version and causes it to become the version selected by an unpinned installation.
  3. A user follows the documented npm install or openclaw plugin install command.
  4. npm downloads the attacker-controlled release.
  5. Malicious lifecycle scripts may execute during installation, or malicious plugin logic executes when OpenClaw loads the installed package.
  6. The payload oper ...[truncated 762 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, rather than allowing the registry to select the current release.
  2. Record and verify the package integrity hash through an npm lockfile or an equivalent immutable manifest.
  3. Include the reviewed plugin source in the audit scope, or publish verifiable source and reproducible-build instructions.
  4. Verify package provenance and registry signatures where supported.
  5. Install with lifecycle scripts disabled where compatible, then explicitly run only reviewed setup operations.
  6. Execute the plugin under a dedicated, least-privileged account with restricted filesystem and network access.
  7. Add automated dependency monitoring and require security review before updating the pinned version.

other

Warning
Location
references/discovery.md:5
Finding

Automatic Peer Discovery Discloses Agent Metadata to Remotely Selected Hosts

Content
View full analysis

Vulnerability Details

File Location: references/discovery.md:5-9; related bootstrap behavior at references/discovery.md:13-16
Vulnerability Type: other: Privacy and Network Metadata Exposure
Risk Level: Medium

Vulnerable behavior documented in references/discovery.md:

text
1. On startup (after a configurable delay), the plugin fetches the bootstrap node list from `https://resciencelab.github.io/DAP/bootstrap.json`
2. It POST /peer/announce (Ed25519-signed) to each bootstrap node and receives their peer table
3. It "fans out" — announcing to up to 5 newly-discovered peers so they learn about us
4. A periodic gossip loop (default 10 min) re-announces to random known peers to keep the table fresh

Related remote bootstrap configuration:

text
5 bootstrap nodes across AWS regions. Current addresses are fetched from [`https://resciencelab.github.io/DAP/bootstrap.json`](https://resciencelab.github.io/DAP/bootstrap.json) at startup; hardcoded fallbacks are used when unreachable.

Technical Analysis

On startup, the plugin retrieves a mutable bootstrap-node list from an external URL and announces the local agent to every listed node. It subsequently announces to newly discovered peers and periodically repeats announcements to random known peers.

This behavior exposes network-participation metadata, including the agent identity, source network address, timing, and potentially the endpoint information needed for peer communication. The remote bootstrap list influences which systems receive these announcements, but the audited project contains no documented signature verification, certificate pinning, destination allowlist, or user confirmation for changes to that list.

Ed25519 signatures authenticate protocol payloads and protect their integrity, but they do not conceal metadata. The documentation states that the transport uses plain HTTP/TCP, so application signatures do not provide tran ...[truncated 2062 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user opt-in before the first bootstrap announcement and clearly state what metadata will be disclosed.
  2. Display or log the resolved announcement destinations before contacting them.
  3. Cryptographically sign the bootstrap manifest and verify it against a key pinned in the reviewed package.
  4. Maintain a restrictive allowlist of approved bootstrap domains or public keys and reject unexpected destinations.
  5. Use authenticated encrypted transport, such as HTTPS or mutually authenticated TLS, for peer announcements and messages.
  6. Provide a discovery-disabled mode and a manual-peer mode that do not contact bootstrap infrastructure.
  7. Minimize announced fields, rotate identifiers where protocol requirements allow, and avoid publishing private or unnecessary endpoints.
  8. Apply connection rate limits, request-size limits, replay protection, and strict validation to all exposed peer endpoints.
  9. Document separately that message delivery is peer-to-peer while discovery relies on externally operated bootstrap infrastructure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation text is overly broad because it triggers on generic mentions of 'agent IDs' and direct messaging between agents without stronger scoping constraints. This can cause the skill to activate in unrelated contexts and steer an agent toward network-capable actions when the user did not clearly intend to use P2P messaging, increasing the chance of unnecessary data exposure or unintended external communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill describes peer discovery, endpoint listing, and message transmission but does not explicitly warn that these actions send traffic to external peers and may reveal the user's network-reachable endpoints or message content metadata to other nodes. In a P2P context, omitting this notice can lead users or higher-level agents to initiate network actions without informed consent, making accidental information disclosure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The discovery design causes agents to automatically contact remote peers, announce their presence, and participate in periodic gossip over the network without any explicit user consent or prominent warning about external communications. In a P2P messaging skill, this behavior can expose metadata such as agent address, availability, peer relationships, and network identifiers, and it expands the attack surface by initiating outbound connections to potentially untrusted infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The examples encourage peer discovery and direct agent-to-agent messaging over plain HTTP/TCP without warning about metadata exposure, network scanning implications, or the trust risks of contacting arbitrary peers. In a P2P messaging skill, omission of privacy and network-impact guidance can lead users to expose agent identifiers, probe local/network peers, or connect to untrusted endpoints under the assumption that the workflow is routine and safe.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.