ClawHub
Back to skill

Security audit

PCClaw

Security checks for vulnerabilities and agentic risk

Overview

PCClaw appears to be a legitimate Windows skills pack, but it needs human review because its installer and several skills grant broad local control and sensitive data access without enough safeguards.

Install only after reviewing the remote installer or using the manual skill-copy path. Treat this as a broad Windows automation bundle: approve browser history, clipboard, screenshot/OCR, microphone, filesystem, package, UI automation, and scheduled-task actions only when you explicitly requested them. Store OAuth refresh tokens carefully, revoke them if exposed, and periodically inspect/remove PCClaw scheduled tasks and PATH changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:39
Finding

Mutable Remote PowerShell Installer Is Executed Without Inspection

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
skills/win-scheduler/SKILL.md:188
Finding

Scheduler Skill Exposes Persistent Arbitrary Command Execution

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
skills/win-whisper/SKILL.md:29
Finding

Downloaded Whisper Executables Are Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/ms-todo/SKILL.md:50
Finding

Long-Lived Microsoft Refresh Token Is Stored in Plaintext Configuration

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
web/index.html:24
Finding

Website Executes Unpinned Third-Party JavaScript

Content
View full analysis
``` ### Technical Analysis The website loads and executes JavaScript from a third-party CDN at runtime. The URL is not tied to an immutable version, and the tag does not include a Subresource Integrity hash. The inspected page also does not show a restrictive Content Security Policy governing script sources. A compromised CDN response or upstream distribution channel could execute arbitrary JavaScript in the website's origin. This is particularly relevant because the page displays and copies the project's PowerShell installation command. ### Attack Path 1. An attacker compromises the CDN, upstream publishing process, or dependency distribution account. 2. The CDN serves malicious JavaScript in response to the existing URL. 3. A visitor loads the PCClaw website and the browser executes the malicious script. 4. The script changes the visible or clipboard-copied installation command, redirects the visitor, or performs other origin-accessible actions. 5. The visitor executes a substituted command, potentially leading to local code execution. ### Impact Assessment The immediate impact is arbitrary JavaScript execution in the website's origin for affected visitors. The script can alter page content and installation instructions and can access non-HttpOnly origin data if any exists. Because the site promotes a PowerShell command that executes downloaded code, modification of the copied command can bridge browser compromise into operating-system command execution if the visitor pastes and runs it. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (86)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

│ └── skills\ # PCClaw skills (after install) └── .config
└── moltbook
└── credentials.json

text

## Uninstall

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/google-tasks/SKILL.md (reported line 100)May include surrounding context.

md
1. Create a project in [Google Cloud Console](https://console.cloud.google.com)
2. Enable the **Google Tasks API**
3. Create **OAuth 2.0 Client ID** (Desktop application)
4. Download `client_secret.json`, note the `client_id` and `client_secret`

### Authenticate

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/google-tasks/SKILL.md (reported line 121)May include surrounding context.

-d "grant_type=authorization_code" | jq .

text

Save the `refresh_token`. Refresh access tokens as needed:

```bash
ACCESS_TOKEN=$(curl -s -X POST https://oauth2.googleapis.com/token \

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill explicitly guides users through minting access tokens from a stored refresh token, enabling continued delegated access to Microsoft To Do data. In context this is necessary for authentication, but from a security standpoint it materially increases credential abuse risk if the refresh token or derived access token is exposed through environment variables, shell history, process inspection, logs, or copied command output.

Content

Scanner excerpt · skills/ms-todo/SKILL.md (reported line 71)May include surrounding context.

}

text

## Getting an Access Token

Tokens expire after ~1 hour. Refresh before each session:

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill description materially understates its capabilities: it claims to only read and search notes, but the body also documents creating, updating, deleting, exporting, and launching the app. This mismatch can mislead users or higher-level agents into granting trust or invoking the skill in contexts where write actions and bulk extraction were not expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow step 'check what user was browsing' normalizes surveillance-style use of the skill without requiring consent, authorization, or a legitimate support/debugging context. Because the skill provides direct procedures to extract recent browsing activity, this workflow materially increases the likelihood of misuse against a user's private data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is presented as a system-information and diagnostics tool, but it also includes a forceful process-termination capability. That expands it from read-only inspection into destructive system control, creating a misleading trust boundary and enabling denial-of-service or interruption of security tools, user applications, or critical processes if invoked carelessly or abusively.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Broad access to all environment variables is not justified by the stated purpose of hardware and system diagnostics. Because environment variables commonly store API keys, cloud credentials, proxy secrets, and service configuration, this functionality creates a direct confidentiality risk disproportionate to the skill's declared use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The process termination examples show both graceful close and force kill, including Stop-Process -Force, with no warning that this can terminate arbitrary applications and lose unsaved work. In a UI automation context, termination capabilities are powerful and legitimate, but presenting force-kill as a simple example without safety guidance materially increases the risk of destructive misuse.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 9)May include surrounding context.

html
<title>PCClaw — OpenClaw for Windows | Native Skills for Your AI Agent</title>
    <meta name="description" content="The missing Windows experience for OpenClaw. 16 skills (14 Windows-native + 2 cross-platform), one-command installer, and Moltbook integration. Get your AI agent running on Windows in 2 minutes.">

    <!-- Open Graph -->
    <meta property="og:title" content="PCClaw — OpenClaw for Windows">
    <meta property="og:description" content="14 Windows-native AI agent skills + one-command installer. The missing piece for OpenClaw on PC.">
    <meta property="og:image" content="https://openclaw.irisgo.xyz/og-image.png">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 179)May include surrounding context.

html
PCClaw brings 14 Windows-native skills to OpenClaw — screenshot, OCR, UI automation, clipboard, browser integration, task scheduling, local AI inference, file management, system diagnostics, speech (STT + TTS), notifications, and more. Plus a one-command installer.
            </p>

            <!-- Quick Install Command -->
            <div class="code-block p-5 text-left max-w-xl mx-auto mb-3">
                <button class="copy-btn" onclick="copyCommand(this)">Copy</button>
                <code class="text-green-400 text-base md:text-lg">irm openclaw.irisgo.xyz/i | iex</code>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 197)May include surrounding context.

html
</p>

            <div class="bg-white rounded-2xl shadow-sm overflow-hidden">
                <!-- Header -->
                <div class="ecosystem-row bg-ocean text-white px-6 py-3 text-sm font-semibold">
                    <span></span>
                    <span>macOS (built-in)</span>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 289)May include surrounding context.

html
</div>
    </section>

    <!-- Skills Showcase -->
    <section class="py-16 px-4 bg-white">
        <div class="max-w-5xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-3">16 Skills, Ready to Go</h2>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 431)May include surrounding context.

html
</div>
    </section>

    <!-- How It Works -->
    <section class="py-16 px-4">
        <div class="max-w-4xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-12">2 Minutes, Zero to Running</h2>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 476)May include surrounding context.

html
<h2 class="text-3xl font-bold text-ocean text-center mb-12">Install</h2>

            <div class="grid md:grid-cols-2 gap-8">
                <!-- Interactive -->
                <div class="bg-sand rounded-xl p-6">
                    <div class="flex items-center gap-3 mb-4">
                        <span class="text-2xl">🪟</span>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · web/index.html (reported line 606)May include surrounding context.

html
</div>
    </section>

    <!-- FAQ -->
    <section class="py-16 px-4 bg-white">
        <div class="max-w-3xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-12">FAQ</h2>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The win-scheduler entry states that the skill can create, manage, trigger, export, and delete Windows scheduled tasks. Because scheduled-task changes can alter system behavior and persistence, the markdown should disclose that these operations can affect system startup or automation state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The win-browser entry says the skill can read bookmarks, browsing history, downloads, and active tab titles across browser profiles. This behavior touches sensitive personal browsing data, but the markdown provides no privacy warning or disclosure about accessing that information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file announces that the win-files skill can perform create/copy/move/delete operations, which can directly affect user data and system state. The description presents these capabilities as features but includes no caution, confirmation expectation, or warning about destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The win-whisper entry includes audio recording, streaming transcription, subtitle output, and translation features. These actions can capture sensitive spoken content, yet the markdown does not warn users about privacy implications or the need to ensure consent before recording.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The win-ui-auto skill is described as able to click, type text, send hotkeys, move windows, and launch or quit applications. Such automation can trigger unintended actions or data loss, but the markdown provides no warning about verifying targets or reviewing automated actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The win-clipboard entry states that the skill can read and write clipboard contents including text, images, and file lists. Clipboard contents often contain sensitive material, and the markdown does not disclose that using the skill may expose or overwrite private data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The quick-start command downloads and immediately executes remote PowerShell code via 'irm ... | iex', which prevents users from reviewing the script before execution. This pattern is dangerous because any compromise of the hosting domain, TLS trust chain, or published installer content can lead to arbitrary code execution on the user's Windows machine.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README makes a strong privacy claim that API keys 'stay on your machine' and are 'never collect[ed] or transmit[ted],' yet the documented installer performs remote account/agent registration and posts a first message to an external service. Even if the key itself is not sent, the documentation is materially incomplete and can mislead users into exposing setup metadata or consenting to network actions they did not expect.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

md
| Skill | What it does | Dependencies |
|-------|-------------|--------------|
| [`win-notify`](skills/win-notify/SKILL.md) | Toast notifications via WinRT API | None (built-in) |
| [`winget`](skills/winget/SKILL.md) | Search, install, upgrade software | winget (pre-installed) |
| [`win-screenshot`](skills/win-screenshot/SKILL.md) | Full screen, region, or window capture | None (built-in .NET) |
| [`win-clipboard`](skills/win-clipboard/SKILL.md) | Read/write text, images, file lists | None (built-in .NET) |

Static analysis

No suspicious patterns detected.