ClawHub
Back to skill

Security audit

Frontend Engineer

Security checks for vulnerabilities and agentic risk

Overview

This frontend guidance skill is mostly ordinary, but it embeds an unrelated paid audit upsell that asks users to install another skill and use third-party identity verification.

Review this skill before installing. Its core frontend guidance appears ordinary, but do not follow the qa-security install command or clawtip identity-verification step unless you independently trust that skill, its publisher, its permissions, and the verification provider's data-handling terms.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:817
Finding

Unpinned Third-Party Skill Installation and Undocumented Identity-Verification Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 817–825
Vulnerability Type: Unverified third-party Skill dependency and insufficiently documented external verification service
Risk Level: Medium

Vulnerable Content

The following is an English rendering of the complete affected section:

markdown
## Need more professional frontend security and quality assurance?

This Skill provides general frontend development guidance. Before release, remember to perform an in-depth inspection:

| Paid Skill | Purpose | Price |
|------------|---------|-------|
| **qa-security** | Frontend vulnerability scanning (XSS/CSRF), dependency security analysis, end-to-end testing strategy design, and pre-release security review | 390 UT (CNY 3.9 per use) |

After identity verification through the third-party clawtip verification service, a complete audit report will be delivered.
Installation command: `openclaw skills install qa-security`

Technical Analysis

The frontend engineering Skill directs users to install the third-party qa-security Skill using only a mutable package name. The instruction does not specify an immutable version, cryptographic digest, verified publisher identity, source repository, reviewed manifest, or trusted registry. Consequently, the behavior and provenance of the installed component cannot be established from the audited project.

The section also directs users to complete identity verification through a third-party service named clawtip, but it does not document:

  • The service endpoint or operator identity.
  • The categories of identity or account information collected.
  • The destination, retention period, or subsequent use of submitted data.
  • The authentication and transport-security requirements.
  • Whether the verification process is optional.
  • The permissions obtained by the installed Skill.

No executable network request, credential collection logic, or direct ex ...[truncated 3080 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the promotional installation and identity-verification section because it is not necessary for the Skill's declared frontend engineering functionality.
  2. If the external Skill is functionally required, reference it through a trusted registry and pin an immutable version and cryptographic digest.
  3. Publish and verify the dependency's publisher identity, source repository, license, manifest, requested capabilities, and security-review status.
  4. Require explicit user confirmation before installing or invoking any third-party Skill. Do not allow installation to occur implicitly.
  5. Display the complete permission set before installation and deny filesystem, credential, network, shell, or persistent-state access unless individually necessary.
  6. Execute the dependency in a sandbox with least-privilege tool access, network allowlisting, restricted filesystem access, and no inherited secrets.
  7. Provide a verifiable rollback and removal procedure for the installed Skill.
  8. Before directing users to identity verification, document the service operator, endpoint, data fields collected, purpose, legal basis, retention period, deletion procedure, subprocessors, and privacy policy.
  9. Minimize verification data and avoid transmitting credentials, authentication tokens, source code, environment files, or unrelated personal information.
  10. Require encrypted transport and explicit informed consent, and provide a non-verification alternative when identity collection is not essential.
  11. Add automated policy checks that reject unpinned Skill installation commands and undocumented external data-processing instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes generic phrases such as "build a UI," "create a frontend," "make a component," and broad terms like "responsive design" and "cross-platform." The file does not provide exclusion conditions, contextual limits, or negative examples, so the activation scope remains wider than necessary for a skill intended to select among many specializations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill embeds an unrelated paid upsell for a separate security-audit service and instructs users to use a third-party identity-verification flow (clawtip) plus install another skill. This expands the trust boundary beyond the declared frontend-engineering purpose and can socially engineer users into external actions, dependency installation, or disclosure to an unvetted service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Chinese-only promotional text is embedded in an otherwise English skill and contains operational instructions for obtaining a paid audit via third-party verification and installation. This can hide material behavior from users and reviewers who only read English, making the external upsell and trust-boundary expansion less transparent and therefore more dangerous in context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.