Security audit

SEO to Kanban Workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent with its Kanban-dashboard purpose, but it requires an unpinned external plugin and automatically sends task details and generated HTML files to a cloud service.

Install only if you are comfortable adding the external claw-kanban plugin and sending task descriptions, research logs, progress data, and generated HTML to the cloud Kanban service. Avoid using it with confidential drafts, client data, unpublished strategy, credentials, or regulated personal information unless the plugin version, service controls, retention policy, and access permissions have been reviewed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Mandatory Installation of an Unpinned Third-Party Plugin
Content: View full analysis
**⚠️ CORE DEPENDENCY (MUST INSTALL)** > Because OpenClaw needs the actual code to sync data to the cloud dashboard and send API requests, this skill acts as the "brain", but it requires the "hands". > > You MUST install the companion code plugin from NPM for this workflow to function: > ```bash > openclaw plugins install claw-kanban > ``` > *Get your free Dashboard API Key to see the visualization at: **https://webkanbanforopenclaw.vercel.app*** ``` ### Technical Analysis The skill requires installation of the `claw-kanban` NPM plugin by package name without specifying an immutable version, package integrity hash, verified source revision, or trusted publication key. Package-manager installation causes executable third-party code to be retrieved outside the reviewed skill package. The companion plugin's source is not included in the audited project. Consequently, its install hooks, runtime behavior, filesystem access, network operations, credential handling, and update behavior cannot be verified from this artifact. Even if the package is benign at review time, a compromised maintainer account, malicious future release, package takeover, or registry supply-chain incident could alter the code subsequently installed by users. ### Attack Path 1. An attacker compromises the package publisher, registry account, or upstream release process for `claw-kanban`. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the skill's mandatory installation instruction without a pinned version or integrity verification. 4. OpenClaw retrieves and installs the attacker-controlled release. 5. Installation hooks or plugin initialization execute the malicious code with the permissions available to the OpenClaw process. 6. The malicious plug ...[truncated 636 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Uncontrolled Transmission of Task Content and Generated Artifacts to a Cloud Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill promotes a cloud Kanban dashboard and instructs installation of a companion plugin, but it does not clearly warn that task content, research notes, and progress data may be transmitted to a third-party remote service. In this context, SEO and content tasks may contain unpublished drafts, client information, or proprietary strategy, so silent syncing materially increases confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to adopt a broad, automatic workflow for "any SEO or content task," including remote dashboard updates, local file creation, and artifact attachment. This is risky because the invocation scope is not tightly constrained to user-approved actions, so normal content requests could trigger unnecessary external data transmission and file operations without explicit per-task consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that it saves final HTML locally and attaches the generated file to the Kanban card, but it does not present this as a clear warning or ask for user approval. This creates risk of unintended local persistence and remote exposure of generated content, especially if the output contains sensitive business material or client deliverables.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.