ClawHub
Back to skill

Security audit

FeedNest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed FeedNest integration guide with account-management tools that fit its stated purpose, though users should install the required plugin carefully.

Install only if you trust the FeedNest plugin publisher and are comfortable giving it access through a FeedNest API key. Review the plugin package/version you install, avoid unnecessary account permissions where possible, and confirm destructive or bulk actions such as deleting tags or marking all articles as read.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–16
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Requirements

This skill requires the FeedNest plugin. Install it first:

openclaw plugins install @feednest/openclaw

text

Technical Analysis

The skill directs users to install @feednest/openclaw without specifying an immutable version, checksum, signature, or other integrity constraint. Consequently, the package resolved at installation time may differ from the package originally reviewed.

The project contains only SKILL.md; it does not include the plugin implementation or dependency lock data. Therefore, the external plugin's code, installation hooks, runtime behavior, and transitive dependencies cannot be verified from the audited artifact. This creates supply-chain risk if the registry package, publisher account, release process, or a transitive dependency is compromised.

Attack Path

  1. An attacker compromises the package publisher, registry entry, release pipeline, or a dependency used by @feednest/openclaw.
  2. The attacker publishes a malicious release under the expected package name or causes unsafe dependency resolution.
  3. A user follows the documented command: openclaw plugins install @feednest/openclaw.
  4. Because no version or integrity value is specified, the installer resolves the attacker-controlled release.
  5. Malicious installation or runtime logic executes with the permissions available to the OpenClaw process.
  6. Depending on those permissions and exposed credentials, the malicious plugin could access FeedNest data, API credentials, local files, or other resources available to that process.

Impact Assessment

Successful exploitation could execute attacker-controlled plugin code within the OpenClaw environment. The precise impact depends on ...[truncated 539 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to a reviewed, immutable version rather than installing the latest available release, for example using the package manager's supported exact-version syntax.
  2. Record and verify a cryptographic checksum, package signature, or registry provenance attestation where supported.
  3. Document the authoritative registry, publisher identity, and expected package namespace to reduce dependency-confusion and typosquatting risk.
  4. Audit the selected plugin release, installation hooks, and transitive dependencies before recommending installation.
  5. Use a lockfile or equivalent dependency manifest so installations resolve reproducibly.
  6. Run the plugin under least privilege and restrict its filesystem, network, process-execution, and credential access to resources strictly required for FeedNest operations.
  7. Establish a controlled upgrade process in which new releases are reviewed and integrity metadata is updated before users install them.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep