ClawHub
Back to skill

Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill queries Polaris's news API for user-requested news commands and shows no hidden local access, persistence, or destructive behavior.

Before installing, understand that news searches and brief topics are sent to The Polaris Report API by default. Avoid sensitive queries unless you trust that backend or configure POLARIS_API_URL to an approved service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The README advertises real-time news, briefing, and search features backed by an external Polaris service, but does not clearly disclose that user prompts, search terms, and usage metadata will be transmitted to a third-party backend. This creates a transparency and privacy issue because users or downstream agents may submit sensitive queries under the assumption that processing is local or self-contained.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:9