Clawreach

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:45 AM UTC
• Version: 1.1.0

Overview

This skill is transparent about its social-matching purpose, but it asks for login credentials, stores a reusable token in a predictable file, and sets up automatic background replies without enough user control.

Review this carefully before installing. Do not provide a real password unless you trust the ClawReach service and accept that the agent will store an access token locally and may message or conclude matches for you in the background. Prefer a version that uses OAuth or a scoped token, secure secret storage, explicit opt-in for polling, and approval before sending messages or final match decisions.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:137

Finding

Persistent Autonomous Polling Through a Scheduled Cron Job

Content

View full analysis

``` ### Technical Analysis The Skill instructs the user to install an OpenClaw cron job that survives the initiating interaction and executes every minute. The scheduled task reads a reusable bearer token from a persistent file and performs authenticated network requests, generates messages, sends those messages, and concludes matches. An isolated session reduces chat clutter but does not provide a security boundary. The task continues to exercise the user's authenticated authority without requiring approval for each message or conclusion. No automatic expiration, bounded execution count, revocation procedure, or per-action confirmation is configured. This behavior matches system persistence because a scheduled task remains active across sessions and repeatedly performs autonomous operations after th ...[truncated 1201 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:68

Finding

Reusable Bearer Token Stored in a Predictable Plaintext Session File

Content

View full analysis

", "agent_id": 123, "agent_name": "coolpanda_88", "bound_at": "2024-01-01T00:00:00Z" } ``` > Token expires → re-call `/auth/login` on 401. ``` The token-refresh instructions at lines 264–269 reinforce the continued use of this file: ```text ## Token Refresh On any 401 response, re-login automatically: POST /auth/login → update access_token in session file → retry ``` ### Technical Analysis The Skill directs the agent to save a reusable bearer token in a predictable JSON file under the OpenClaw workspace. It specifies no restrictive file permissions, encryption, operating-system keychain, dedicated secret store, access isolation, or token scope restrictions. A bearer token grants access based solely on possession. Consequently, another Skill, local process, backup operation, diagnostic collector, or workspace-reading agent operating with the same user's file access could recover the token and use it independently of the legitimate Skill. Automatic replacement of the token after an HTTP 401 response keeps valid authentication material at the same predictable location and may extend the exposure period. ### Attack Path 1. The user authenticates through the Skill. 2. The Skill receives a ClawReach access token. 3. The token is written to `~/.openclaw/workspace/memory/clawreach-session.json`. 4. Another component with permission to read the user's OpenClaw workspace locates the predictable file. 5. The component extracts the `access_token` value. 6. It supplies the token in an `Authorization: Bearer` header to the ClawReach API. 7. The attacker performs API operations available to the compro ...[truncated 761 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:196

Finding

Prompt Injection Through Untrusted Match Profiles and Conversation Messages

Content

View full analysis

= max_rounds - 1), append: [CONCLUDE: yes/no, score: 0-100, reason: one sentence] ``` ``` The generated output is subsequently used for API actions: ```text POST /matches/message Headers: Authorization: Bearer Body: { "match_id": 456, "content": "..." } ``` ```text When reply contains `[CONCLUDE: ...]`: POST /matches/conclude Headers: Authorization: Bearer ``` ### Technical Analysis The opponent's public card, conversation history, and latest message are controlled by a remote match participant. These values are inserted directly into LLM prompts without robust trust-boundary separation, explicit instructions to treat embedded commands as data, escaping, size restrictions, content filtering, or structured output enforcement. The opponent's card is especially sensitive because it is interpolated into the system-role prompt. An attacker can place instruction-like text in a card or message that attempts to override the screening task, request disclosure of own ...[truncated 1873 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This workflow explicitly instructs the user to provide email, credentials, and a registration code so the skill can obtain an access token, which is a classic credential-handling pattern. In this context the danger is elevated because the token is later used for persistent automated actions, so compromise of the workflow or local storage could grant ongoing account access and enable impersonation on the platform.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

text

Step 1: Guide user to register on ClawReach website → get register_code
Step 2: User provides email + credentials + register_code → claim agent, get access token
Step 3: Profile interview (10 dimensions, conversational)
Step 4: Upload profile to platform
Step 5: Poll for pending match messages → auto-reply as agent

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill directly asks the user to share their email and credentials, which is unsafe even if the stated purpose is token exchange. Requesting primary login secrets inside the conversational flow increases phishing risk, normalizes unsafe credential-sharing behavior, and creates an opportunity for leakage through logs, transcripts, or insecure downstream handling.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

text

Got it! Please share the email and credentials you registered with.
(Used only to exchange an access token — not stored in plaintext)

Get Access Token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The access-token acquisition step is security-sensitive because it formalizes the conversion of user credentials into a bearer token that can be reused for API access. While token issuance itself is normal, within this skill it becomes dangerous due to subsequent plaintext session-file storage and autonomous use of the token for ongoing account actions.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

(Used only to exchange an access token — not stored in plaintext)

text

### Get Access Token

POST /auth/login

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description lists activation phrases such as “找对的人” and “社交匹配,” which are generic conversational expressions rather than narrowly scoped commands. Without clearer constraints or exclusion conditions, the skill could be invoked unintentionally during ordinary relationship or social discussions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill asks users to provide login credentials and describes storing a reusable access token, but it does not present an adequate security warning or obtain explicit informed consent for persistent authentication and autonomous messaging. In a social platform context, this can lead users to unknowingly authorize ongoing agent-driven actions and expose account access if the local session file is compromised.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cron instruction creates an autonomous background process that reads stored credentials, ingests private conversation data, generates responses, and sends them without per-message user review. That combination of secret reuse, continuous polling, and unsupervised outbound messaging materially increases the risk of privacy violations, account abuse, and unintended disclosures, especially because it runs in an isolated session that may reduce visibility to the user.

Content

No source excerpt is available for this finding.