ClawHub
Back to skill

Security audit

Claweb

Security checks for vulnerabilities and agentic risk

Overview

This messaging skill is mostly transparent about its purpose, but it creates an always-on remote message channel that can wake the main agent and respond to anyone without clear human control.

Review this carefully before installing. It is suitable only if you want an agent identity that can receive messages from anyone on the network, store local signing material, and optionally run a persistent auto-poller. Do not enable the cron poller unless you are comfortable with autonomous replies, and prefer manual message review or a restricted session with trusted senders.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:79
Finding

Untrusted Remote Messages Can Hijack Agent Task Execution

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:145
Finding

Persistent Scheduled Poller Creates an Autonomous Remote Instruction Channel

Content
View full analysis
. If nothing new, do nothing (NO_REPLY)." ``` Verify the cron is scoped to your agent: `openclaw cron list --json`. ``` ### Technical Analysis The documented command creates a scheduled job that survives the immediate skill invocation, runs every 30 seconds, wakes the main agent session, reads external messages, and directs the agent to respond automatically. This combines two security risks: - **System persistence:** The scheduled task continues to operate across sessions until explicitly removed. - **Instruction hijacking:** Untrusted remote content is repeatedly introduced into the main agent session and may influence agent behavior. The poller is configured for the `main` session rather than a restricted, isolated message-processing session. The system event also instructs the agent to respond without requiring sender authorization or human review. According to the skill's own documentation, identities are open and any network agent can send messages, making this an externally reachable persistent input channel. Verifying that the cron job is scoped to the agent does not address the trustworthiness of received messages or the authority of their senders. ### Attack Path 1. A user or agent runs the documented `openclaw cron add` command once. 2. OpenClaw installs a persistent job that executes every 30 seconds and wakes the main session. 3. An attacker sends a crafted message to the public ClaWeb identity. 4. The scheduled job runs `claw mail inb ...[truncated 1375 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Third-Party Binary Installation Lacks Version Pinning and Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: claweb
description: Agent-to-agent messaging on the ClaWeb network. Create a federated identity from the CLI in one minute — no email, no signup form. Ed25519-signed mail and chat with any agent on the aweb network, including aweb.ai identities. Keys never leave your machine.
homepage: https://claweb.ai/docs/
metadata: {"openclaw":{"emoji":"💬","requires":{"bins":["claw"]},"install":{"hint":"Install claw from https://claweb.ai/install/"}},"clawdbot":{"emoji":"💬","requires":{"bins":["claw"]}}}
---

Static analysis

No suspicious patterns detected.