ClawHub
Back to skill

Security audit

qa-security

Security checks for vulnerabilities and agentic risk

Overview

This paid security-review skill is disclosed as a clawtip-gated service, but its broad payment/credential workflow and weak local order verification deserve review before installation.

Install only if you are comfortable with a paid clawtip-based workflow that can read credentials, use network access, write persistent order files, and execute external payment tooling. Avoid putting secrets, source code, or sensitive project details in the initial question, and treat the local payment verification as weak until the publisher hardens credential validation and dependency integrity.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/service.py:19
Finding

Payment Authorization Can Be Forged Through Editable Local Order Data

Content
View full analysis

Vulnerability Details

File Location: scripts/service.py:19-26, 45-57
Vulnerability Type: Improper credential validation and fail-open payment status
Risk Level: High

Vulnerable Code

python
def is_credential_valid(order_data: dict) -> bool:
    credential = order_data.get("payCredential")
    if not credential:
        return False
    credential_ts = order_data.get("credentialTimestamp")
    if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL:
        return False
    return True
python
if not is_credential_valid(order_data):
    print("PAY_STATUS: ERROR")
    print("ERROR_INFO: 未找到有效的支付凭证。请先通过 clawtip 完成支付。")
    sys.exit(1)

pay_status = order_data.get("payStatus", "SUCCESS")
print(f"PAY_STATUS: {pay_status}")

if pay_status != "SUCCESS":
    print(f"ERROR_INFO: 支付状态为 {pay_status}，无法续进")
    sys.exit(1)

print("AUTHORIZATION_RESULT=verified")

Technical Analysis

Payment authorization relies entirely on fields loaded from a locally writable JSON order file. The code considers any truthy payCredential value valid; it does not verify a digital signature, trusted issuer, credential structure, payment recipient, amount, order number, or indicator.

The credential timestamp is optional. If credentialTimestamp is absent, expiration is not enforced. In addition, payStatus defaults to SUCCESS when absent, creating a fail-open authorization path.

Consequently, the local file is treated simultaneously as untrusted storage and as the authoritative payment-verification source. A cryptographically verifiable statement from the payment provider is never required.

Attack Path

  1. Run scripts/create_order.py to create an order and obtain its order number.
  2. Locate the order JSON under ~/.openclaw/skills/orders/{indicator}/{order_no}.json.
  3. Add a truthy attacker-controlled value such as "payCredential": "x".
  4. Omit `credentialTim ...[truncated 692 chars]
Remediation
View remediation

Remediation Suggestions

  • Require a payment credential signed by a trusted Clawtip key and verify the signature locally using a pinned, trusted public key.
  • Bind the verified credential to the exact order number, amount, recipient, indicator, merchant identity, and expiration time.
  • Require credentialTimestamp and payStatus; reject the credential if either field is missing or malformed.
  • Remove the SUCCESS default and fail closed for absent or unknown payment states.
  • Validate types before arithmetic or comparison operations.
  • Protect order files with restrictive permissions, but do not treat filesystem permissions as a replacement for cryptographic verification.
  • Record and reject already-consumed credentials if payment credentials are intended for one-time use.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create_order.py:40
Finding

Encryption Failure Silently Falls Back to Plaintext and Uses Unauthenticated ECB Mode

Content
View full analysis

Vulnerability Details

File Location: scripts/create_order.py:40-58; scripts/sm4_utils.py:58-66
Vulnerability Type: Fail-open encryption and unauthenticated deterministic encryption
Risk Level: Medium

Vulnerable Code

python
encrypt_payload = json.dumps({
    "orderNo": order_no,
    "amount": str(AMOUNT),
    "payTo": pay_to,
}, ensure_ascii=False)

encrypted_data = encrypt_payload
if sm4_key:
    try:
        # Support both hex (32 chars) and base64 keys
        if len(sm4_key) == 32 and all(c in "0123456789abcdefABCDEF" for c in sm4_key):
            encrypted_data = sm4_encrypt_hex(sm4_key, encrypt_payload)
        else:
            encrypted_data = sm4_encrypt_base64(sm4_key, encrypt_payload)
    except Exception as e:
        print(f"WARNING: SM4 encryption failed: {e}")
python
def sm4_encrypt_ecb(key, data):
    if len(key) != 16: raise ValueError("SM4 key must be 16 bytes")
    pad = 16 - (len(data) % 16)
    data = data + bytes([pad] * pad)
    rk = _key_expand(key)
    out = b""
    for i in range(0, len(data), 16): out += _enc_block(data[i:i+16], rk)
    return out

def sm4_encrypt_hex(key_hex, plain):
    return sm4_encrypt_ecb(bytes.fromhex(key_hex), plain.encode("utf-8")).hex()

def sm4_encrypt_base64(key_b64, plain):
    return base64.b64encode(sm4_encrypt_ecb(base64.b64decode(key_b64), plain.encode("utf-8"))).decode()

Technical Analysis

encrypted_data is initially assigned the plaintext JSON payload. If the encryption key is missing, encryption is skipped. If the key is malformed or encryption otherwise fails, the exception is reduced to a warning and order creation continues with the original plaintext value.

When encryption succeeds, the implementation uses SM4 in ECB mode. ECB is deterministic and exposes equality patterns between identical plaintext blocks. It also provides no authentication tag, so the application cannot ...[truncated 1519 chars]

Remediation
View remediation

Remediation Suggestions

  • Fail closed when CLAWTIP_SM4_KEY is absent, malformed, or unusable if encryption is required by the payment protocol.
  • Validate the key format and decoded length before constructing or saving the order.
  • Replace ECB with an authenticated-encryption mode supported by the protocol, such as SM4-GCM, using a fresh unpredictable nonce for each order.
  • Store the nonce and authentication tag with the ciphertext and require successful tag verification before downstream processing.
  • Do not initialize an encryption output variable with plaintext where an exception can leave that plaintext in place.
  • Apply restrictive file permissions to the order directory and files because they also contain the user's question in a separate plaintext field.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Workflow Executes Externally Resolved Dependencies Without Immutable Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:43, 65
Vulnerability Type: Supply-chain exposure through runtime installation and execution
Risk Level: Medium

Vulnerable Code

bash
openclaw skills install clawtip
bash
npx --yes @clawtip/clawtip-sandbox-cli@1.0.0 pay -o <ORDER_NO> -i <INDICATOR> -v 1.0.12

Technical Analysis

The documented workflow directs users or agents to install a named Skill and allows npx to resolve, download, and execute a registry package. The Clawtip Skill installation command does not identify an immutable artifact version or digest. The sandbox package specifies a version, which reduces accidental version drift, but it does not independently establish artifact authenticity or integrity against registry compromise.

Because the fetched components execute outside the reviewed project files, their effective behavior is not represented by this static audit. A compromised package registry, publisher account, or mutable dependency source could introduce code that executes with the permissions of the invoking user or agent.

The bundled Python scripts themselves contain no direct HTTP client and no remote payload download. This finding concerns the documented third-party dependency workflow rather than hidden retrieval in the bundled scripts.

Attack Path

  1. An attacker compromises the relevant package, publisher account, registry entry, or Skill distribution source.
  2. The user or agent follows SKILL.md and runs the installation or npx command.
  3. The external source supplies a malicious artifact under the expected dependency name or version.
  4. The package installation lifecycle or command entry point executes attacker-controlled code.
  5. That code operates with the filesystem, environment, network, and credential access available to the invoking process.

Impact Assessment

Successful supply-chain compromise could result in arbitrary code exe ...[truncated 361 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every external Skill and package to an immutable, reviewed artifact digest rather than relying only on a name or semantic version.
  • Use a trusted registry with signature verification and enforce package integrity through a checked-in lockfile where supported.
  • Vendor and audit the exact dependency artifacts when operationally feasible.
  • Disable unnecessary installation lifecycle scripts and avoid runtime package resolution in privileged environments.
  • Run payment tooling in a sandbox with minimal filesystem, credential, environment-variable, and network access.
  • Document the expected publisher, registry, package digest, and verification procedure so operators can detect substitution.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The presence of custom SM4 encryption/payment payload handling is materially different from the advertised AI security-review functionality, and no actual audit behavior is documented in this file. While encryption itself is not inherently malicious, undisclosed cryptographic and payment-processing logic inside a supposed audit skill increases opacity and can conceal risky handling of user or payment data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The presence of custom SM4 encryption/payment payload handling is materially different from the advertised AI security-review functionality, and no actual audit behavior is documented in this file. While encryption itself is not inherently malicious, undisclosed cryptographic and payment-processing logic inside a supposed audit skill increases opacity and can conceal risky handling of user or payment data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The presence of custom SM4 encryption/payment payload handling is materially different from the advertised AI security-review functionality, and no actual audit behavior is documented in this file. While encryption itself is not inherently malicious, undisclosed cryptographic and payment-processing logic inside a supposed audit skill increases opacity and can conceal risky handling of user or payment data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The presence of custom SM4 encryption/payment payload handling is materially different from the advertised AI security-review functionality, and no actual audit behavior is documented in this file. While encryption itself is not inherently malicious, undisclosed cryptographic and payment-processing logic inside a supposed audit skill increases opacity and can conceal risky handling of user or payment data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script for a purported security-audit skill creates payment/order artifacts, reads payment recipient data, and persists an order object containing the user's question. That behavior is unrelated to the declared audit/review purpose and is a strong indicator of monetization or exfiltration workflow hidden inside a security-branded skill, which raises supply-chain and trust concerns.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file provides a dedicated capability for locating, reading, and writing order artifacts in a user home directory. That operational data-management capability is not justified by the stated purpose of delivering code quality and security audit guidance, which would not normally require maintaining order records on disk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes a code quality and security review skill, but this module implements local order-data storage and retrieval under a per-user directory. Persisting arbitrary order records is not an obvious implementation detail of AI-delivered security guidance and indicates behavior outside the described audit/review function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's implemented behavior is almost entirely payment verification and service authorization, not QA/security auditing as declared in the skill metadata. This mismatch is dangerous because it can be used to disguise monetization, gating, or deceptive workflow logic under a trusted security-review label, increasing the chance that users or platforms grant the skill more trust than its actual function warrants.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction "请使用中文与用户交互" requires all user interaction to be in Chinese and does not offer an alternative language or ask for user preference. This is a natural-language locale policy issue because it forces a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code reads payment destination and encryption key material from environment variables in a skill advertised for security review, which is unnecessary for the stated function and increases the risk of misuse. It also falls back to storing plaintext payload data when encryption is unavailable or fails, potentially exposing payment metadata and user-supplied content in local artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user-facing natural-language text in Chinese, including docstrings and later runtime error messages, without offering any language choice or documenting a locale-specific constraint. That conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest scopes the skill to security review guidance and vulnerability/dependency assessment, but this function reads structured order files from a fixed user-local path. Accessing application order records is not clearly tied to performing code audits and therefore diverges from the declared behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function docstring is written only in Chinese, reinforcing a fixed-language experience in a file that otherwise has no stated locale limitation or opt-in. This is a natural-language policy issue rather than a code security flaw.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The credential validation logic introduces a payment/authorization capability unrelated to the stated QA-security auditing purpose. In this context, the issue is not cryptographic weakness in the check itself, but the unjustified collection and enforcement of payment state, which expands the skill's capabilities beyond user expectations and can support deceptive access control or unauthorized monetization flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains user-visible error strings in Chinese only, including order-read and payment-credential failure messages. The skill does not offer a language choice or document that it is intended for a Chinese-only audience, which creates a natural-language locale policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file implements a full standalone SM4 encryption utility, which is unrelated to the stated QA/security-audit purpose of the skill. Mismatch between declared purpose and embedded crypto capability increases the risk of hidden data-transformation or exfiltration support, especially because the code provides easy string-to-hex/base64 wrappers that can be used operationally rather than for analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The exposed helpers provide direct ECB-mode encryption of arbitrary plaintext into hex or base64, creating a ready-made mechanism to transform sensitive content into opaque ciphertext within a skill that is supposed to perform QA/security review. ECB mode is also insecure for many use cases because it lacks semantic security for repeated blocks, so this is both suspiciously unnecessary capability and poor cryptographic practice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code includes a hard-coded Chinese error message (订单创建失败) while the rest of the script is otherwise English-facing. That creates a locale-specific user experience without user opt-in or documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.