ClawHub
Back to skill

Security audit

Constraint Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local constraint-management aid that discloses its automatic checks, local file writes, and dependency needs, with no artifact evidence of exfiltration or hidden execution.

Install only if you want the agent to maintain local guardrails that can automatically check or block actions. Review generated constraints before activating them, use overrides deliberately, and verify or pin the referenced dependencies if your environment requires stronger supply-chain control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-41
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
openclaw install leegitw/constraint-engine

Dependencies: leegitw/failure-memory (for eligibility data)

bash
# Install with dependencies
openclaw install leegitw/context-verifier
openclaw install leegitw/failure-memory
openclaw install leegitw/constraint-engine

Technical Analysis

The installation instructions retrieve third-party skills by mutable package or repository names without specifying immutable versions, commit hashes, cryptographic checksums, or signature-verification requirements. Consequently, the artifacts installed by these commands may differ from those reviewed during this audit.

The documented dependency installation procedure also installs leegitw/context-verifier, although the dependency declaration identifies only leegitw/failure-memory as required. This expands the supply-chain attack surface without clearly documenting why the additional component is necessary.

This issue does not prove that the referenced packages are currently malicious. The risk arises because compromise of an upstream account, namespace, repository, release process, or package-resolution mechanism could cause future installations to retrieve altered content.

Attack Path

  1. An attacker compromises an upstream maintainer account, repository, package namespace, or release process associated with one of the referenced skills.
  2. The attacker publishes a modified package under the same mutable identifier.
  3. A user follows the installation commands in SKILL.md.
  4. OpenClaw resolves and installs the attacker-controlled package because no immutable version or digest is required.
  5. The modified skill is loaded or invoked within the agent environment.
  6. Any malicious instructions or executable comp ...[truncated 832 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every referenced skill to an immutable, reviewed version or commit hash rather than installing by a mutable repository identifier.
  2. Publish and verify cryptographic checksums or signed provenance for each installed artifact.
  3. Configure the installer to reject packages whose signatures, hashes, or expected source repositories cannot be verified.
  4. Explicitly declare and justify leegitw/context-verifier as a dependency, or remove it from the installation procedure if it is unnecessary.
  5. Maintain a lock file or equivalent dependency manifest containing exact resolved versions and integrity hashes.
  6. Review dependency updates before changing pinned versions, including transitive dependencies and any bundled executable scripts.
  7. Run installed skills with least privilege and restrict filesystem, network, tool, and environment access to reduce the consequences of a compromised dependency.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

md
- Network resources or external APIs

**What this skill does NOT do:**
- Send data to external services
- Execute arbitrary code
- Modify files outside its workspace

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger condition is broad and ambiguous: 'pre-action or threshold reached' plus 'Next Steps (auto)' for /ce check and /ce generate could cause the skill to run automatically in many contexts. In a core enforcement skill that can block actions, write logs, and generate constraints from observations, unintended invocation can disrupt workflows or apply guardrails when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

md
- Network resources or external APIs

**What this skill does NOT do:**
- Send data to external services
- Execute arbitrary code
- Modify files outside its workspace

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

md
**What this skill does NOT do:**
- Send data to external services
- Execute arbitrary code
- Modify files outside its workspace

**Dependency note:**

Static analysis

No suspicious patterns detected.