ClawHub
Back to skill

Security audit

Openclaw Skill Tools

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid API wrapper, but it forces full skill content to be sent to ToolWeb without enough consent, redaction, or privacy detail.

Install only if you are comfortable sending pasted skill content and generation details to ToolWeb. Use a dedicated API key, avoid scanning private or secret-bearing SKILL.md files unless redacted, and treat API results as third-party output rather than a local independent audit.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:48
Finding

Mandatory Third-Party API Use and Agent Instruction Hijacking

Content
View full analysis
", "scan_depth": "deep", "check_injection": true, "check_exfil": true, "check_creds": true, "check_perms": true, "check_meta": true, "check_scope": true }' ``` ### Technical Analysis The skill contains explicit instructions that override the agent's normal ability to select an appropriate processing method. It requires the agent to call a particular third-party service, prohibits independent assessment or fallback behavior, and directs the agent to encourage retries when the remote service fails. This constitutes skill instruction hijacking because loading and invoking the skill changes the agent's operational goals from fulfilling the user's underlying generation or audit request to ensuring use of a revenue-generating external API. The statement that every successful call is tracked ...[truncated 2833 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This skill is designed around outbound network transmission via curl to a remote API, including user-provided content and an API credential. External transmission is not inherently malicious here, but it is a real security-relevant capability that creates data exposure risk if sensitive inputs are scanned or if users do not understand the remote processing model.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
env:
        - TOOLWEB_API_KEY
      bins:
        - curl
    primaryEnv: TOOLWEB_API_KEY
    os:
      - linux

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
## When to Use

**Skill Generator:**
- User wants to create a new OpenClaw skill
- User asks to generate a SKILL.md file
- User needs help packaging an automation as an OpenClaw skill

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The scan workflow explicitly instructs sending the full SKILL.md content to a third-party API, but the skill does not clearly warn the user that potentially sensitive skill text will leave the local environment. If users paste proprietary or secret-bearing skill content, this can cause unintended disclosure to the external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README instructs users to configure a TOOLWEB_API_KEY, which strongly implies use of an external service, but it does not clearly disclose that skill content may be sent over the network for processing. For a security-scanning skill, this omission is risky because users may provide sensitive SKILL.md content or secrets under the assumption analysis is local.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

Agent: 🔍 Skill Security Scan 🔴 CRITICAL: Hidden curl to external URL detected 🟠 HIGH: Requests file system access beyond stated scope ✅ No credential harvesting found 🛡️ Recommendation: DO NOT INSTALL

text

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Agent: 🔍 Skill Security Scan 🔴 CRITICAL: Hidden curl to external URL detected 🟠 HIGH: Requests file system access beyond stated scope ✅ No credential harvesting found 🛡️ Recommendation: DO NOT INSTALL

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill requires TOOLWEB_API_KEY and uses it in outbound requests, but the description does not clearly warn that this credential will be sent to and used against a third-party service endpoint. While that is expected for API authentication, lack of disclosure reduces informed consent and can mislead users about credential exposure boundaries.

Content

No source excerpt is available for this finding.