ClawHub
Back to skill

Security audit

英语音标标注技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed English pronunciation aid for Chinese-speaking learners, with a minor installation supply-chain caution but no evidence of malicious behavior.

This appears safe for its stated purpose. Before installing, prefer a pinned or verified ClawHub package version if available, and be aware that the skill is designed mainly for Chinese-speaking learners and will include pinyin-style pronunciation aids by default.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.bat:3
Finding

Unpinned Remote Skill Installation

Content
View full analysis

Vulnerability Details

File Location: install.bat:3
Additional Location: README.md:14-17
Vulnerability Type: Unpinned third-party skill dependency
Risk Level: Medium

Vulnerable Code:

install.bat:3

bat
clawhub install english-phonetic-skill

README.md:14-17

bash
clawhub install english-phonetic-skill

Technical Analysis

The installation command retrieves a remote registry package using only the mutable package name english-phonetic-skill. It does not pin an immutable version or content digest and does not explicitly verify a package checksum, signature, or publisher identity.

Consequently, the package installed by this command is not guaranteed to be identical to the locally audited project files. A later package release, registry compromise, publisher-account compromise, or package ownership transfer could cause the same command to install modified instructions, scripts, or other unreviewed content.

The issue is a supply-chain weakness rather than evidence that the package currently available from the registry is malicious.

Attack Path

  1. An attacker compromises the registry entry, publisher account, release process, or another component controlling the named package.
  2. The attacker publishes a modified release under the existing english-phonetic-skill name.
  3. A user downloads this project and executes install.bat, or manually follows the equivalent command in README.md.
  4. clawhub resolves the mutable package name to the attacker-controlled release.
  5. The unreviewed remote package is installed.
  6. The user restarts OpenClaw as instructed, causing the remotely obtained Skill content to be loaded and used.

Impact Assessment

Successful exploitation could replace the reviewed Skill with attacker-controlled Skill content. The resulting impact depends on the permissions and capabilities granted to installed Skills and the OpenClaw runtim ...[truncated 474 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer installing the locally audited artifact rather than resolving a separate remote package by name.
  2. If remote installation is required, pin an immutable package version and, where supported, a cryptographic content digest.
  3. Verify the package publisher's identity and require registry signature validation before installation.
  4. Publish and verify a SHA-256 or stronger checksum for the exact package archive.
  5. Configure the installer to fail closed if the expected version, digest, signature, or publisher identity does not match.
  6. Inspect the downloaded package contents before activation and confirm that they match the reviewed source.
  7. Record the locked package version and digest in both install.bat and README.md so automated and manual installation procedures use the same verified artifact.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill description is written in Chinese and does not indicate any option for other languages, while the skill itself processes English text. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description states the skill provides Chinese pinyin pronunciation equivalents and is particularly suited for Chinese native speakers, which bakes in a specific locale/language assumption. Under the policy, language or locale constraints should be offered as a user choice or clearly framed as an opt-in regional specialization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The overview and quick navigation describe automatic annotation with Chinese pinyin for user input, with no indication that users can disable it or choose another locale-specific aid. This can be a language/locale policy issue because the skill behavior defaults to one language-specific representation without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The batch file presents all user-facing output in Chinese ("正在安装英语音标标注技能..." and "安装完成！请重启 OpenClaw 会话以加载新技能。") with no indication that the skill is intended only for Chinese-speaking users or that another language option exists. This creates a language/locale policy issue because it forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.