ClawHub
Back to skill

Security audit

Smartlead

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly related to Smartlead automation, but its setup enables a persistent OpenClaw plugin from an unaudited hardcoded local path and wires lead-reply data into an agent/Slack workflow.

Review this skill before installing. It is not evidence of malware, but only use setup.sh if you have separately reviewed the OpenClaw plugin at /home/worker/code/openclaw-smartlead, understand that Smartlead reply data may be sent through OpenClaw to Slack, and are comfortable enabling persistent webhook-driven agent behavior. Prefer pinned, reviewed CLI/plugin versions and avoid linked development-mode installs in production.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
setup.sh:13
Finding

Unverified External Plugin Is Linked and Enabled

Content
View full analysis

Vulnerability Details

File Location: setup.sh, lines 13 and 19–22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

bash
PLUGIN_DIR="/home/worker/code/openclaw-smartlead"
bash
if command -v openclaw >/dev/null 2>&1; then
  echo "Installing plugin in linked mode..."
  openclaw plugins install -l "$PLUGIN_DIR" || true
  openclaw plugins enable smartlead || true
else
  echo "openclaw CLI not found. Skipping plugin install commands."
fi

Technical Analysis

The setup script links and enables an OpenClaw plugin from the fixed absolute path /home/worker/code/openclaw-smartlead. That plugin is outside the audited project, which contains only SKILL.md and setup.sh; therefore, its source, integrity, provenance, and credential-handling behavior cannot be verified from this artifact.

Linked installation also means subsequent modifications at the external path may alter the code executed by OpenClaw without changing the reviewed Skill. Any user or process capable of writing to that path could replace or modify the plugin. The || true clauses suppress installation and enablement errors, reducing visibility into partial or unexpected setup states.

Attack Path

  1. An attacker, compromised build process, or another local user gains write access to /home/worker/code/openclaw-smartlead.
  2. The attacker places a malicious plugin there or modifies the expected plugin.
  3. The user executes setup.sh.
  4. The script links the external directory and enables the plugin without verifying its identity or integrity.
  5. OpenClaw loads the unverified plugin.
  6. The plugin can process Smartlead webhook content and may gain access to data or capabilities exposed to plugins by the OpenClaw runtime.

Impact Assessment

Successful exploitation could execute attacker-controlled plugin code with the privileges of the OpenClaw process. Depending on ...[truncated 491 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the plugin source within the reviewed project or retrieve it through a versioned, authenticated dependency mechanism.
  • Resolve a bundled plugin relative to the setup script instead of using a fixed external path.
  • Pin the plugin to a reviewed version or commit and verify a cryptographic checksum or signature before installation.
  • Validate that the plugin directory and files are not writable by untrusted users.
  • Avoid linked/development-mode installation in production environments.
  • Remove || true; fail closed and display actionable errors if installation or enablement fails.
  • Review the plugin separately for secret handling, webhook authentication, payload sanitization, outbound network destinations, and runtime permissions.

T08 · Insecure Dependencies

Note
Location
setup.sh:84
Finding

Unpinned Third-Party CLI Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: setup.sh, lines 84–91
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable code:

bash
echo "Optional: install smartlead-cli for manual debugging (not required by the plugin):"
if command -v uv >/dev/null 2>&1; then
  echo "  uv tool install smartlead-cli"
elif command -v pip3 >/dev/null 2>&1; then
  echo "  pip3 install --user smartlead-cli"
else
  echo "  (uv/pip3 not found)"
fi

Technical Analysis

The setup helper recommends installing smartlead-cli without pinning a reviewed version or providing an integrity hash. These commands are printed rather than automatically executed, which limits immediate exploitability. However, a user following the instructions will resolve whichever package version the configured package index currently serves.

This creates supply-chain exposure to a compromised future release, package-index compromise, dependency compromise, or package-source misconfiguration. The CLI is especially sensitive because the Skill directs it to use SMARTLEAD_API_KEY and access lead and message-history data.

Attack Path

  1. A malicious or compromised smartlead-cli release becomes available through the user's configured Python package source, or that source is redirected to an unsafe repository.
  2. The user follows the setup helper's printed uv or pip3 command.
  3. The package manager installs the unpinned release.
  4. Package installation hooks or later CLI execution run compromised code under the user's account.
  5. During CLI use, malicious code could attempt to access the Smartlead API key, configuration files, command inputs, or returned customer data.

Impact Assessment

Exploitation could result in code execution with the installing user's privileges. Because the CLI is intended to handle SMARTLEAD_API_KEY, lead records, email addresses, and message history, a compromised package could ...[truncated 330 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin smartlead-cli to a specific reviewed version.
  • Install from an authenticated, documented package source.
  • Use a lockfile or hash-verified installation, such as pip hash checking, to ensure artifact integrity.
  • Document the authoritative package publisher and expected package identity.
  • Review the pinned package and its transitive dependencies before recommending it for environments containing Smartlead credentials.
  • Prefer an isolated tool environment with only the minimum required filesystem and environment-variable access.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description says the skill manages Smartlead campaigns, leads, and webhooks via the smartlead CLI. However, this code chunk does not implement those management operations. It is a setup script focused on OpenClaw integration: installing a plugin, showing OpenClaw hooks/plugin configuration, describing webhook payload examples, and wiring Smartlead EMAIL_REPLY webhooks into an agent/slack workflow. While it mentions optional installation of smartlead-cli for debugging, the primary behavior is webhook/plugin setup rather than command-line management of Smartlead resources. That is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
## Deletion Behavior

Delete commands prompt for confirmation in interactive shells. In scripts/automation, pass `--yes`
to skip prompts.

Examples:

Static analysis

No suspicious patterns detected.