ClawHub
Back to skill

Security audit

Keychat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Keychat installer, but it tells the agent to install changing third-party code and run an auto-downloaded native bridge that is not pinned or verified.

Install only if you trust the @keychat-io publisher and its binary distribution path. Prefer a pinned reviewed plugin version, documented bridge checksums or signatures, and a clear rollback path before using it with sensitive messaging identities or agent accounts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party Plugin Downloads and Executes an Unverified Native Binary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8-15, SKILL.md:20-23, and SKILL.md:28-32
Vulnerability Type: Unpinned dependency with remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

SKILL.md:8-15:

markdown
```bash
openclaw plugins install @keychat-io/keychat
openclaw gateway restart

Supported platforms: macOS (ARM/x64), Linux (x64/ARM64).

The plugin automatically downloads the bridge binary, configures channels.keychat in openclaw.json, and generates a new Nostr identity on first start.

text

`SKILL.md:20-23`:

```markdown
- **bridge-client.ts** — Spawns a Rust sidecar for Signal Protocol and MLS Protocol encryption (Keychat's crypto is implemented in Rust, needs bridging to Node.js)
- **keychain.ts** — Stores identity mnemonics in the OS keychain (macOS Keychain / Linux libsecret) for security

SKILL.md:28-32:

markdown
```bash
openclaw plugins install @keychat-io/keychat@latest
openclaw gateway restart
text

### Technical Analysis

The installation instructions do not pin `@keychat-io/keychat` to an immutable, reviewed version. The upgrade command explicitly requests `@latest`, allowing the package resolved by the registry to change after this Skill has been audited.

The documentation also states that the installed plugin automatically downloads a native bridge binary and spawns it as a Rust sidecar. No immutable bridge version, download URL, checksum, digital signature, or verification procedure is provided in the reviewed project. Consequently, the code ultimately executed is not contained in the Skill and cannot be validated from the audited artifact.

Restarting the OpenClaw gateway activates the externally supplied plugin and sidecar. According to the Skill, these components can modify `openclaw.json`, create a Nostr identity, and interact with identity mnemonics stored in the operating-system keychain. This creates a s
...[truncated 1979 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @keychat-io/keychat to a specific, reviewed version instead of using an unversioned package specifier or @latest.
  2. Use package-manager integrity metadata and a committed lockfile where the OpenClaw installation mechanism supports them.
  3. Pin the native bridge to an immutable release and document its exact version and authoritative download origin.
  4. Publish expected SHA-256 digests for every supported bridge artifact and verify the digest before execution.
  5. Cryptographically sign bridge releases and fail closed if signature verification fails.
  6. Require explicit user confirmation before downloading or starting native code, modifying openclaw.json, generating an identity, or restarting the gateway.
  7. Run the plugin and bridge with the minimum necessary filesystem, network, keychain, and process permissions.
  8. Separate bridge update operations from normal startup so that an already reviewed binary is not silently replaced.
  9. Document the plugin and binary update policy, provenance controls, and rollback procedure.
  10. Consider reproducible builds or publishing source-to-binary attestations so users can independently validate the native artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.