ClawHub
Back to skill

Security audit

Miromind

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MiroMind research helper, but it should be reviewed because it stores a reusable password, sends research queries to MiroMind, and saves full reports locally.

Install only if you are comfortable giving OpenClaw browser automation access to a MiroMind account. Use a dedicated MiroMind account with a unique password, avoid submitting confidential or regulated data unless approved, review MiroMind's data practices, restrict access to OpenClaw config and output directories, and periodically delete reports or session files you no longer need.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned Third-Party Browser Automation Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:40-43; duplicated in README.md:41-44 and README_zh_CN.md:41-44
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
# 1. Install Playwright MCP Skill
clawhub install playwright-mcp

# 2. Ensure the Playwright browser is installed
npx playwright install chromium

Technical Analysis

The installation instructions resolve and install third-party components without specifying exact versions, integrity hashes, lockfiles, or verified publishers. Consequently, the code installed when a user follows these instructions may differ from the dependency that existed when this Skill was audited.

The clawhub install playwright-mcp command depends on a mutable marketplace package, while npx playwright install chromium relies on the locally or dynamically resolved Playwright tooling and downloads a browser artifact. The project does not provide controls for authenticating the expected package or browser artifact.

This is a supply-chain weakness rather than evidence that the current upstream components are malicious.

Attack Path

  1. An attacker compromises an upstream package, marketplace account, package release, registry resolution path, or browser artifact distribution channel.
  2. The compromised component is published under the dependency name used by these unpinned commands.
  3. A user follows the documented installation procedure.
  4. The package manager or marketplace resolves the attacker-controlled release because no exact trusted version or integrity value is required.
  5. Malicious installation or runtime code executes under the user's account.
  6. Because the dependency performs browser automation, the malicious component may access browser state, research content, local files available to the process, and credentials exposed to the OpenClaw environment.

Impact Assessment

...[truncated 491 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin playwright-mcp to an exact, reviewed version rather than resolving the latest marketplace release.
  2. Pin the Playwright tooling and Chromium revision to known-compatible versions.
  3. Publish expected checksums or digital signatures for downloaded artifacts and verify them before installation.
  4. Document the trusted publisher, registry, and package identifier to reduce dependency-confusion and typosquatting risk.
  5. Use a lockfile or equivalent immutable dependency manifest where supported.
  6. Run browser automation in a sandboxed, least-privileged account with restricted filesystem and environment access.
  7. Establish a dependency update process that requires review and testing before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:54
Finding

Reusable Account Password Stored in General OpenClaw Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:54-72; duplicated in README.md:58-71 and README_zh_CN.md:58-71
Vulnerability Type: Plaintext sensitive credential storage guidance
Risk Level: Medium

Vulnerable Code

bash
# Open openclaw.json
openclaw config edit
json
{
  "env": {
    "MIROMIND_EMAIL": "your@email.com",
    "MIROMIND_PASSWORD": "your-password"
  }
}

Technical Analysis

The Skill directs users to persist a reusable MiroMind account password in the env section of openclaw.json. A general configuration file is not necessarily a protected secret store. The instructions do not require restrictive file permissions, encryption at rest, secret redaction, a dedicated operating-system credential vault, or a revocable scoped token.

Any local process, plugin, backup system, diagnostic collector, or other user that can read this configuration may recover the account password. Environment propagation can further expose the credential to child processes or debugging and crash-reporting facilities.

No hardcoded real credential is present in the repository. The weakness is the prescribed method for storing user-supplied credentials.

Attack Path

  1. A user follows the configuration instructions and writes a real MiroMind email address and password into openclaw.json.
  2. The configuration file is made available to another local process, plugin, user, backup archive, support bundle, or accidentally committed repository.
  3. The party with access reads MIROMIND_EMAIL and MIROMIND_PASSWORD.
  4. The recovered credentials are used to authenticate to MiroMind outside the Skill.
  5. The attacker can access or misuse the account according to the permissions associated with those credentials.

Impact Assessment

Exploitation can compromise the configured MiroMind account and expose its research sessions, chat URLs, submitted research topics, and other account ...[truncated 330 chars]

Remediation
View remediation

Remediation Suggestions

  1. Store credentials in an operating-system keychain, OpenClaw-supported secret store, or dedicated secrets manager instead of ordinary configuration.
  2. Prefer a revocable, narrowly scoped API token or delegated authentication mechanism over a reusable account password when the service supports one.
  3. If a configuration-file reference is unavoidable, store only a secret identifier and resolve the value from the protected secret store at runtime.
  4. Require restrictive filesystem permissions so only the OpenClaw service account can read the relevant secret.
  5. Prevent credentials from appearing in logs, exceptions, diagnostic bundles, process listings, and generated reports.
  6. Ensure configuration and session files are excluded from version control and unencrypted backups.
  7. Run the Skill and browser automation under a dedicated least-privileged account.
  8. Document credential rotation and revocation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises automatic saving of complete research reports to the local workspace but does not warn that outputs may contain sensitive prompts, proprietary data, or regulated content. Because this skill performs deep research on user-supplied topics and persists the full result automatically, it can create unintentional local data retention and exposure risks on shared or backed-up systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx playwright install chromium without pinning a package version, which can pull whatever Playwright version is current in the user's environment or registry resolution path. In an agent skill that depends on browser automation, unpinned tooling increases supply-chain and reproducibility risk because future or substituted versions may introduce breaking behavior or malicious code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs users to place MIROMIND_EMAIL and MIROMIND_PASSWORD in OpenClaw configuration, creating persisted credentials for an external website. While credential storage is often necessary for automation, documenting long-lived plaintext-style config storage without guidance on secret handling increases the risk of credential disclosure through local compromise, backups, logs, or workspace sharing.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md
## Configuration

### Step 1: Create a MiroMind account

Sign up at [https://dr.miromind.ai](https://dr.miromind.ai).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explains usage and links to the external MiroMind service but does not clearly warn that user questions are transmitted to dr.miromind.ai for processing. Since users may submit confidential research topics, company analysis, or incident-related questions, lack of disclosure can lead to unintended sharing of sensitive information with a third-party service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The README instructs users to run npx playwright install chromium without pinning a specific Playwright version. This can lead to non-reproducible installs and increases supply-chain risk if a newer dependency release is compromised or introduces unsafe behavior. In a skill that automates browser actions and handles credentials, unpinned tooling is more sensitive than in a purely local utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README asks users to configure MIROMIND_EMAIL and MIROMIND_PASSWORD and notes automatic login behavior, but does not clearly warn that the skill will programmatically use and submit these credentials to a third-party website. This is dangerous because users may not appreciate that browser automation will handle live account credentials, expanding credential exposure through automation logs, browser state, screenshots, or compromise of the remote service. The skill context makes this more dangerous because it combines stored credentials with automated web interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes sending user research prompts to MiroMind for processing but does not clearly warn that submitted questions and their contents will be transmitted to a third-party service. Users may unknowingly submit sensitive business, personal, or regulated data, creating confidentiality and compliance risks. Because this skill is explicitly for 'deep research' on arbitrary topics, the likelihood of sensitive input is significant.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest presents the skill as a research tool, but the body also automates third-party login and persists reports locally. This capability mismatch reduces informed consent and can cause users to provide sensitive prompts or credentials without realizing data will be sent to an external service and stored on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language content is effectively Chinese-only, including the description, prompts, examples, status checks, and UI expectations, with no opt-in or statement that the skill is intended only for Chinese-language use. Under SQP-3, forcing a specific language without user choice is a policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs use of npx playwright without pinning a specific version, which makes execution depend on whatever package version is current at install/runtime. That creates a supply-chain risk: a malicious or breaking upstream release could alter behavior in a credential-handling browser automation skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation explains how to configure credentials and automate login, but does not clearly warn that user research queries and possibly sensitive content will be transmitted to a third-party website under the user's account. This is a transparency and consent issue that can lead to unintended disclosure of proprietary or personal information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill reads MIROMIND_EMAIL and MIROMIND_PASSWORD from environment variables and uses them for automated login to an external site. In a research-oriented skill, this is sensitive capability expansion; compromise of the skill, browser session, or logs could expose account credentials or misuse the linked account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README states that complete research reports are automatically saved as local Markdown files but does not clearly warn users about local persistence of potentially sensitive outputs. This can expose confidential prompts, generated analysis, or extracted third-party content to other local users, backups, indexing tools, or later unintended disclosure. The impact is lower than credential misuse, but still meaningful in a research workflow that may process sensitive topics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill flow states that a report file path is returned, but it does not clearly warn users up front that full research results are saved to local Markdown files. Silent persistence can leave sensitive research content on disk longer than intended and expose it to other local users or backup systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.