Security audit

StockLobster

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent StockLobster-to-OpenClaw webhook guide, but it routes raw webhook text into the main agent over a documented plaintext HTTP bearer-token endpoint without clear validation or isolation.

Install only if you can restrict the hook to trusted senders, use HTTPS or a private tunnel, rotate a dedicated hooks token, and preferably change the mapping to validate structured fields and use a dedicated low-privilege notification agent instead of `main`. Do not expose the documented HTTP endpoint directly on an untrusted network.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:31
Finding: Untrusted Webhook Content Is Executed as an Agent Instruction
Content: View full analysis
" } ``` `SKILL.md:54-55`: ```text 5. Reference incoming webhook fields through `payload`, for example `{{payload.text}}`. ``` `references/payload-format.md:13-19`: ```text For the simple ingestion path, the OpenClaw mapping should reference: ```text {{payload.text}} ``` ``` ### Technical Analysis The mapping inserts the complete caller-controlled `payload.text` value directly into `messageTemplate` and submits the rendered result to the `main` agent. No strict schema validation, instruction/data separation, content filtering, escaping, or restrictive system prompt is documented. Consequently, a webhook request does not have to contain a legitimate stock alert. An authenticated caller can instead place adversarial instructions in `text`, and those instructions will be processed as the agent's message. The use of the fixed `hook:stocklobster` session key can also allow malicious content to influence subsequent processing in the same session, depending on OpenClaw's session-history behavior. Authentication with a hooks token limits who can reach the endpoint, but it does not make the webhook payload trustworthy. A leaked token, compromised StockLobster sender, malicious authorized integration, or interception over the documented plaintext HTTP connection would expose this path. ### Attack Path 1. The attacker obtains the hooks bearer token or compromises an authorized webhook sender. 2. The attacker submits a POST request to `/hooks/stocklobster` with a ...[truncated 1325 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:51
Finding: Bearer Token and Webhook Data Are Documented for Transmission over Plaintext HTTP
Content: View full analysis
:18789/hooks/stocklobster` ``` `SKILL.md:63-66`: ```bash curl -X POST 'http://:18789/hooks/stocklobster' \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{"text":"StockLobster alert\nSymbol: TEST\nEvent: screen_hit\nMessage: TEST hit momentum criteria\nPrice: 4.92\nChange: 3.4%\nVolume: 1234567\nStrategy: momentum\nTimestamp: 2026-04-08T02:21:00.000Z"}' ``` ### Technical Analysis The documented endpoint uses unencrypted HTTP while the example sends a bearer token in the `Authorization` header. HTTP provides neither transport confidentiality nor server authentication. Any party able to observe the relevant network path can read the bearer credential and webhook payload. A network-positioned attacker may also alter requests or responses in transit. Because a bearer token grants access based on possession, a captured token can be replayed without knowing another secret. The risk is particularly significant if `` is a remote host, the service listens on a non-loopback interface, or traffic traverses shared, wireless, cloud, or otherwise untrusted networks. The example can be safe only under additional conditions not stated in the command, such as communication exclusively over the loopback interface or inside a separately encrypted tunnel. ### Attack Path 1. An authorized StockLobster sender posts an alert using the documented HTTP endpoint. 2. An attacker with visibility into the network path captures the plaintext `Authorization: Bearer ` header. 3. The attacker replays the token in a new request to the webhook endpoint. 4. The attacker s ...[truncated 1030 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
openclaw gateway restart

text
## Testing with curl ```bash curl -X POST 'http://<HOST>:18789/hooks/stocklobster' \

Static analysis

No suspicious patterns detected.