ClawHub
Back to skill

Security audit

openclaw-insight

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent local analytics purpose, but its recommended install path runs mutable remote code before analyzing private OpenClaw session data.

Review before installing. The local analysis feature is understandable, but do not run the documented curl-to-bash commands unless you trust the remote repository and installer; prefer a signed release, pinned commit, separate download-and-review step, or an isolated user environment. Treat generated reports as sensitive because they may include usage patterns, costs, model choices, and transcript-derived details.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:21
Finding

Mutable Remote Installer Is Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 21
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/linsheng9731/openclaw-insight/main/install.sh | bash

Technical Analysis

This installation command downloads a shell script from the mutable main branch of a personal GitHub repository and immediately executes it with Bash. The user has no opportunity to inspect the downloaded content before execution, and the command does not pin the script to an immutable commit, verify a cryptographic signature, or validate a locally specified checksum.

Although the documentation states that the installer verifies the downloaded binary, that verification does not establish the integrity of the installer itself. A modified installer can omit or falsify any subsequent integrity check.

The declared functionality only requires reading local OpenClaw session data and generating a report. Executing mutable remote installation code is not the minimum privilege or trust required to perform that analysis. The risk is particularly significant because the installed tool is expected to access potentially sensitive conversation transcripts under ~/.openclaw.

Attack Path

  1. An attacker compromises the repository owner’s account, GitHub credentials, release workflow, or main branch, or otherwise causes malicious content to be served as install.sh.
  2. The attacker modifies the installer to include arbitrary shell commands.
  3. A user or agent follows the recommended installation command in SKILL.md.
  4. curl retrieves the attacker-controlled script.
  5. The shell executes the script immediately with all privileges available to the invoking user.
  6. The payload can access local files, including OpenClaw session transcripts and user credentials, modify user configuration, install additional programs, or establish ...[truncated 736 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Publish versioned installer artifacts from a controlled release process.
  • Pin downloads to an immutable release or reviewed commit rather than main.
  • Require users to download the installer as a separate file before execution.
  • Publish a cryptographic signature or checksum through an independently protected channel.
  • Verify the signature or checksum locally before executing the installer.
  • Display and document the exact files, directories, and permissions the installer will use.
  • Avoid requesting administrative privileges; install only into a user-controlled directory such as $HOME/.local/bin.
  • Include the implementation or verifiable source in the reviewed Skill package so its privacy and read-only claims can be audited.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Version-Specific Command Still Executes an Unpinned Remote Installer

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/linsheng9731/openclaw-insight/main/install.sh | bash -s -- --version v1.0.0

Technical Analysis

The --version v1.0.0 argument only requests a particular application version from the installer. It does not pin or authenticate the installer itself. The executable shell content continues to be retrieved from the mutable main branch and runs before its version-selection behavior can be trusted.

This creates a misleading appearance of version pinning. A compromised installer can ignore the argument, download a different artifact, disable verification, or execute a payload before installing the requested version.

Attack Path

  1. An attacker modifies or replaces install.sh on the remote main branch.
  2. A user selects the documented command believing v1.0.0 makes the installation reproducible or pinned.
  3. curl downloads the current, attacker-controlled installer rather than an installer associated immutably with v1.0.0.
  4. Bash executes the malicious installer with the user’s permissions.
  5. The script ignores or subverts the version argument and performs arbitrary local actions.
  6. Any subsequent binary checksum verification can be bypassed because the installer performing that verification is already untrusted.

Impact Assessment

Exploitation results in arbitrary command execution as the invoking user. It can expose or modify all data available to that account, including OpenClaw transcripts, configuration, authentication material, shell startup files, and generated reports. If invoked with elevated privileges, the impact may extend system-wide.

The requested application version does not reduce this impact because attacker-controlled code executes before a trustworthy versio ...[truncated 26 chars]

Remediation
View remediation

Remediation Suggestions

  • Fetch the installer from an immutable tag, release asset, or commit associated with the requested version.
  • Do not execute downloaded data directly through a pipe.
  • Download the installer and application artifact separately.
  • Verify both artifacts using cryptographic signatures or trusted checksums before execution.
  • Ensure signatures are rooted in a key or identity not controlled solely by the same mutable repository content.
  • Make installation fail closed if verification cannot be completed.
  • Document that an application version argument does not authenticate the installer unless the installer URL itself is immutable and verified.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned Source Checkout and Dependency Lifecycle Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-45
Vulnerability Type: Insecure dependencies and mutable build input
Risk Level: Medium

Vulnerable Code

bash
git clone https://github.com/linsheng9731/openclaw-insight.git
cd openclaw-insight
npm install && npm run build

Technical Analysis

The source installation procedure clones the repository’s current default branch without pinning a reviewed commit or signed tag. It then runs npm install and a project-defined build script. These operations can execute package lifecycle scripts and repository-defined commands.

The audited artifact does not include the remote repository’s source files, package.json, lockfile, dependency tree, or build scripts. Consequently, the commands that would execute and the integrity of the dependencies cannot be verified from the supplied project.

This is a supply-chain risk rather than proof that the current remote repository or its dependencies are malicious. However, the documented procedure creates an executable trust path from mutable remote source and third-party packages to the local user account.

Attack Path

  1. An attacker compromises the source repository, its package manifest, its lockfile, or one of its dependencies.
  2. The attacker adds a malicious lifecycle script, build command, or dependency version.
  3. A user follows the documented source installation instructions and clones the mutable default branch.
  4. npm install resolves dependencies and may execute package lifecycle scripts.
  5. npm run build executes the repository-defined build command.
  6. The malicious script runs with the invoking user’s permissions and can access local files and network resources.

Impact Assessment

The potential impact is arbitrary code execution as the invoking user during installation or compilation. Accessible resources may include source code, OpenClaw data, user credentials, e ...[truncated 300 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the source checkout to a reviewed immutable commit or cryptographically signed release tag.
  • Include and enforce a committed dependency lockfile.
  • Use npm ci instead of unconstrained npm install for reproducible installations.
  • Review dependency provenance, integrity hashes, lifecycle scripts, and known vulnerabilities.
  • Use --ignore-scripts when lifecycle scripts are unnecessary; explicitly review and invoke any required scripts.
  • Build in an isolated, non-privileged environment with restricted filesystem and network access.
  • Publish signed, reproducible build artifacts and document how users can verify them.
  • Include the source, package manifest, lockfile, and build definitions in the auditable Skill package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network-retrieved content straight into bash creates a high-risk command chain that turns any upstream tampering into immediate code execution. In the context of a skill document, this is especially dangerous because users may treat the instructions as trusted operational guidance and run them without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Use the official one-click installation script:

bash
curl -fsSL https://raw.githubusercontent.com/linsheng9731/openclaw-insight/main/install.sh | bash

This script will automatically:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger text is broad enough to match common requests about usage, spending, reports, or audits, which increases the chance the skill activates in contexts the user did not clearly intend. Because this skill reads local OpenClaw session data, overbroad invocation can expose sensitive conversation metadata or transcripts through unintended analysis/report generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes analysis of local session history and transcript-derived insights but does not clearly warn that resulting reports may expose sensitive prompts, usage patterns, model choices, cost data, or other private workflow information. Users may unknowingly generate sharable HTML/JSON artifacts containing confidential information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide claims the tool is '100% local' and that no data leaves the machine, yet it instructs users to fetch installation content over the network. Even if runtime analysis is local, this is a misleading security/privacy claim that can cause users to place undue trust in the tool and execute remote code without appropriate caution.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to download and execute a remote shell script directly from the network. This bypasses normal review and makes compromise of the repository, maintainer account, or transport endpoint immediately actionable as arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Use the official one-click installation script:

bash
curl -fsSL https://raw.githubusercontent.com/linsheng9731/openclaw-insight/main/install.sh | bash

This script will automatically:

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The version-pinned variant still downloads and executes a remote script directly, so the same arbitrary code execution risk remains. Pinning a version does not mitigate the danger if the install script itself or hosting account is compromised.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

To install a specific version (e.g., v1.0.0):

bash
curl -fsSL https://raw.githubusercontent.com/linsheng9731/openclaw-insight/main/install.sh | bash -s -- --version v1.0.0

From Source

Static analysis

No suspicious patterns detected.