ClawHub
Back to skill

Security audit

Latitude Observability

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly configures OpenClaw telemetry export to Latitude and discloses the credentials and trace data involved.

Install this only if you intend to send OpenClaw trace telemetry to Latitude or your self-hosted Latitude endpoint. Confirm the endpoint and project slug, protect the Latitude API key, and avoid enabling raw prompt or response capture unless your retention and privacy policy allow it. If your environment requires strict provenance, pin or verify the diagnostics plugin version before installing it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:84
Finding

Unpinned Remote Plugin Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–88
Vulnerability Type: Unpinned third-party plugin installation
Risk Level: Medium

Vulnerable Code

bash
openclaw plugins install clawhub:@openclaw/diagnostics-otel

Technical Analysis

The documented command installs @openclaw/diagnostics-otel from a remote package source without specifying an immutable version, source revision, or integrity digest. Consequently, the code installed when a user follows the instructions may differ from the code that existed when this skill was reviewed.

The project contains no plugin implementation, lockfile, checksum, signature-verification instructions, or other mechanism that establishes the identity and integrity of the downloaded artifact. If the registry account, package, distribution infrastructure, or mutable release is compromised, the installation command could retrieve attacker-controlled code.

Attack Path

  1. An attacker compromises the plugin publisher account, package registry, distribution channel, or mutable package release.
  2. The attacker publishes a modified @openclaw/diagnostics-otel package containing malicious code.
  3. A user follows the installation command in SKILL.md.
  4. OpenClaw resolves and downloads the attacker-controlled package because no immutable version or digest is required.
  5. The plugin executes in the OpenClaw environment and gains access available to that plugin process.

Impact Assessment

A compromised plugin could execute code with the privileges of the OpenClaw process. Depending on the host configuration, this may permit access to OpenClaw configuration, environment variables such as LATITUDE_API_KEY and LATITUDE_PROJECT, locally accessible data, and telemetry processed by the plugin. It could also alter or exfiltrate agent trace data and make network requests using the process's available connectivity.

The exact host-wide impact depends o ...[truncated 146 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to a reviewed, immutable version rather than relying on mutable package resolution.
  • Where supported, require a cryptographic integrity digest or verified publisher signature.
  • Document the authoritative registry and source repository so users can validate package provenance.
  • Maintain a lockfile or equivalent artifact manifest recording the exact reviewed version and hash.
  • Verify the downloaded artifact before installation and reject any digest or signature mismatch.
  • Run the plugin under least privilege with restricted filesystem, environment-variable, and network access.
  • Review and update the pinned version through a controlled dependency-update process rather than automatically consuming new releases.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep