ClawHub
Back to skill

Security audit

openclaw-hxa-connect

Security checks for vulnerabilities and agentic risk

Overview

The plugin has a coherent messaging purpose, but it should be reviewed because its webhook fallback can accept unauthenticated inbound commands and it exposes powerful HXA administration actions.

Review before installing. Use a least-privilege HXA token, require HTTPS hub URLs, configure webhookSecret and allowlists before exposing the webhook route, avoid granting admin-capable tokens to routine messaging bots, and update the WebSocket dependency if the reported advisory applies.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
index.ts:1069
Finding

Unauthenticated Webhooks Are Forwarded as Authorized Agent Commands

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.ts:254
Finding

Bearer Tokens Can Be Transmitted to Plaintext or Unrestricted Hub URLs

Content
View full analysis
{ if (!acct.hubUrl || !acct.hubUrl.startsWith("http")) { throw new Error("HXA-Connect hubUrl not configured or invalid"); } const url = `${acct.hubUrl.replace(/\/$/, "")}${path}`; const headers: Record = { Authorization: `Bearer ${acct.agentToken}`, ...((init.headers as Record) ?? {}), }; if (acct.orgId) { headers["X-Org-Id"] = acct.orgId; } if (init.body) { headers["Content-Type"] = "application/json"; } for (let attempt = 0; attempt <= MAX_SEND_RETRIES; attempt++) { const resp = await fetch(url, { ...init, headers }); ``` The same unrestricted URL is supplied to the WebSocket SDK together with the token: ```ts const client = new HxaConnectClient({ url: acct.hubUrl, token: acct.agentToken, orgId: acct.orgId, reconnect: { enabled: true, initialDelay: 3000, maxDelay: 60000, backoffFactor: 1.5, }, }); ``` ### Technical Analysis The plugin's declared messaging function requires network transmission of messages and an authentication token to the configured HXA-Connect hub. That transmission is necessary. However, the implementation does not enforce a secure transport or a trusted destination. The validation condition uses `startsWith("http")` instead of parsing the URL and checking its protocol. It therefore accepts at least: - `http://...`, which sends credentials and content without trans ...[truncated 2207 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · index.ts (reported line 235)May include surrounding context.

ts
return af.some((a) => String(a).toLowerCase() === name);
}

// ─── Outbound: send message to HXA-Connect ───────────────────
const MAX_SEND_RETRIES = 2;
const RETRY_BASE_MS = 1000;
const CHANNEL_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registered tool exposes broad organization-level administration functions including changing bot roles, creating org tickets, rotating org secrets, renaming profiles, and manipulating threads and artifacts. For a channel plugin, these capabilities materially expand the attack surface: any prompt injection or overly broad tool access could turn a messaging bridge into an admin interface for the external HXA environment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
98% confidence
Finding

The lockfile pins the project to ws 8.19.0, and the provided advisory data indicates this version is affected by an uninitialized memory disclosure issue and a memory-exhaustion denial-of-service issue. Because this package is a WebSocket library used for network-facing communication, a vulnerable version can expose sensitive process memory or allow a remote attacker to degrade availability by sending crafted traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The markdown explains that the plugin provides real-time bot-to-bot messaging via WebSocket and webhook inbound handling, and that it can optionally receive all thread messages. However, it does not include any warning about privacy or data transmission implications, even though these behaviors could affect user data and system privacy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill describes and enables outbound network communication to an external messaging hub, but it declares no explicit tool scope or permission boundary. In an agent ecosystem, missing scope declarations can cause users or orchestrators to underestimate the plugin's ability to send and receive data externally, increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
# Create a thread
curl -sf -X POST ${HUB_URL}/api/threads \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"topic": "Review the report", "tags": ["request"], "participants": ["reviewer-bot"]}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The configuration and API examples repeatedly show bearer tokens and agent tokens in place without any warning to treat them as secrets. Even though the examples use placeholders, the absence of secret-handling guidance increases the chance that users will hardcode real credentials into configs, logs, or repositories, leading to account compromise of the bot and its messaging organization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The tool can persistently modify the host's configuration file via setThreadModeInConfig, changing behavior across future runs. This is dangerous because a remote-triggerable or agent-triggerable command can alter local policy/state beyond transient messaging, creating a configuration integrity risk not obvious from a transport plugin.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The rotate-secret command invokes org secret rotation immediately with no confirmation, warning, or secondary authorization. Secret rotation is a high-sensitivity action that can invalidate integrations or be abused for denial of service and control over trust relationships if exposed to an agent or untrusted prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The plugin is described as a messaging transport, but it also registers a tool that can perform administrative and state-changing actions such as role changes, ticket creation, secret rotation, profile changes, and host config mutation. This capability mismatch increases the chance that operators or higher-level agents will grant it broader trust than intended, enabling privileged actions through a seemingly low-risk channel integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction "English for code" requires comments, commit messages, PR descriptions, and documentation to be in English. This is a natural-language policy constraint that forces a specific language without presenting it as optional or justified by a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entry states that mention_all trigger behavior aligns with @all / @所有人, which embeds a specific locale-specific trigger form in natural language. Because this file does not indicate whether locale selection is optional or configurable, it may reflect a language/locale policy assumption rather than explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction requires comments, commit messages, PR descriptions, and documentation to be in English. This is a natural-language policy constraint that forces a specific language rather than offering a choice or documenting a justified regional requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The handler accesses acct.webhookSecret and compares it against the bearer token for inbound authentication, which is a credential-handling operation. Although functionally appropriate, there is no nearby comment or user-facing disclosure explaining that a configured secret is being consumed for auth decisions in this path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
],
  "author": "Coco AI (https://github.com/coco-xyz)",
  "dependencies": {
    "@coco-xyz/hxa-connect-sdk": "^1.3.1",
    "ws": "^8.18.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"author": "Coco AI (https://github.com/coco-xyz)",
  "dependencies": {
    "@coco-xyz/hxa-connect-sdk": "^1.3.1",
    "ws": "^8.18.0"
  }
}