Claw Insights Install

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:20 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate local observability setup guide, but it should be reviewed because it recommends unverified remote code execution and handles sensitive local OpenClaw session data.

Install only if you trust the `claw-insights` publisher and are comfortable with a local dashboard reading OpenClaw transcripts, logs, cron metadata, and storing metrics. Prefer a pinned, verifiable package or inspected installer over `curl | sh`, keep authentication enabled, bind to localhost or a protected tunnel, and avoid sharing snapshots or API output that may reveal private session content.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24
• Finding: Unverified Remote Installer Is Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 22–24 and 48–52 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # One-line install (recommended) curl -fsSL https://claw-insights.com/install.sh | sh ``` ```bash npm update -g claw-insights # Or re-run the install script curl -fsSL https://claw-insights.com/install.sh | sh ``` ### Technical Analysis The documented installation and upgrade procedures pipe an HTTP response directly into `sh`. The downloaded script is not pinned to a version, saved for inspection, checked against a cryptographic hash, or validated using a digital signature. This creates a mutable code-execution channel: the effective code executed by the Skill can change after the Skill itself has been reviewed. Compromise of the external domain, hosting environment, publication process, DNS infrastructure, or TLS termination could cause attacker-controlled shell commands to be returned and executed. Arbitrary remote shell execution exceeds the minimum privileges necessary to install a known application artifact. A versioned, integrity-verified package or release archive would provide the required installation functionality with a substantially smaller trust boundary. The external installer was not included in the audited project. Its current contents and the claims that the application is read-only, makes no cloud calls, and keeps data local therefore could not be independently verified. ### Attack Path 1. An attacker compromises or otherwise gains control of `https://claw-insights.com/install.sh` or its delivery infrastructure. 2. The attacker changes the response to include malicious shell commands. 3. A user or agent follows the documented installation or upgrade procedure. 4. `curl` retrieves the attacker-controlled response and passes it directly to `sh`. 5. The commands execute immediately with the permissi ...[truncated 823 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl ... | sh` installation and upgrade instructions. - Publish immutable, versioned release artifacts through a verifiable official channel. - Pin installation instructions to a specific audited version rather than retrieving a mutable script. - Publish a SHA-256 or stronger checksum over the exact artifact and preferably sign releases with a documented cryptographic signing key. - Require users to download the installer to a local file, verify its signature and checksum, and inspect it before execution. - Ensure the installer refuses elevated execution unless a narrowly scoped privileged operation is strictly necessary. - Document every filesystem location, service, and permission modified by installation. - Prefer an installer that operates entirely under the invoking user's account and grants access only to the specific OpenClaw files required for observability.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27
• Finding: Unpinned Global npm Installation and Upgrade Expose a Supply-Chain Execution Path## Vulnerability Details **File Location**: `SKILL.md`, lines 26–27 and 48–50 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Or via npm npm install -g claw-insights ``` ```bash npm update -g claw-insights ``` ### Technical Analysis The installation command does not specify an exact package version, integrity value, lockfile, or verified provenance. The upgrade command likewise resolves a package version from the registry at execution time. npm packages may execute lifecycle scripts during installation or upgrade. Therefore, a compromised maintainer account, malicious package release, registry incident, or compromised dependency could result in arbitrary code execution. Global installation increases the package's reach in the user's environment and may expose globally writable or shared executable paths, depending on npm configuration. The npm package and its dependency graph were not included in the audited artifact, so their implementation, lifecycle scripts, provenance, and transitive dependencies could not be reviewed. ### Attack Path 1. An attacker compromises the `claw-insights` npm publication account, release process, package contents, or a dependency resolved by the package. 2. The attacker publishes a malicious version or introduces malicious lifecycle behavior. 3. A user follows `npm install -g claw-insights`, or later runs `npm update -g claw-insights`. 4. npm resolves and downloads the unpinned or newly published package content. 5. Any applicable lifecycle scripts execute with the permissions of the invoking account. 6. The malicious package can access user files, application data, environment variables, and other resources available to that account. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the invoking user's account. Potentially accessible information includes OpenClaw t ...[truncated 350 chars]
• Remediation: ## Remediation Suggestions - Pin installation to an exact reviewed version, such as `claw-insights@X.Y.Z`. - Publish and document package provenance, release signatures, and integrity information. - Audit the package's lifecycle scripts and transitive dependency graph before recommending installation. - Avoid global installation where possible; use a dedicated, unprivileged application directory or isolated runtime account. - Do not invoke npm with `sudo` or another privileged account. - Disable lifecycle scripts during installation when they are not required, and document any scripts that must run. - Replace unrestricted `npm update -g` guidance with an explicit process that selects, reviews, and verifies a specific target version. - Add release pinning and dependency-locking controls so package behavior cannot change independently of the reviewed instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# One-line install (recommended)
curl -fsSL https://claw-insights.com/install.sh | sh

# Or via npm
npm install -g claw-insights

• Confidence: 99% confidence
• Finding: This is direct external script fetching and execution from a remote domain. It is dangerous because it grants immediate shell execution to code that can change over time and may be compromised independently of the published skill content.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# One-line install (recommended)
curl -fsSL https://claw-insights.com/install.sh | sh

# Or via npm
npm install -g claw-insights

• Confidence: 99% confidence
• Finding: The `| sh` chain is a classic unsafe execution pattern because it turns downloaded content directly into shell commands without inspection. This materially increases the danger of any network, hosting, or script compromise and is especially risky in a skill intended to be followed verbatim.

External Script Fetching

High

• Category: Supply Chain

Content

## Verify

```bash
curl http://127.0.0.1:41041/health
# → {"status":"ok",...}
```

• Confidence: 97% confidence
• Finding: Although the location spans nearby benign `curl` usage, the flagged content includes the upgrade step that again fetches and executes a remote installer script. Reintroducing the same unsafe pattern during upgrades compounds supply-chain risk across the product lifecycle.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
npm update -g claw-insights
# Or re-run the install script
curl -fsSL https://claw-insights.com/install.sh | sh
```

## Quick Config

• Confidence: 99% confidence
• Finding: Using `| sh` in the upgrade path has the same arbitrary-code-execution risk as in installation and may be even more likely to be run routinely without scrutiny. This creates an ongoing remote execution channel if the upstream script is altered maliciously.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill strongly markets the tool as local-only and zero-cloud, yet the recommended install and upgrade path downloads and executes a remote script from the network. This creates a trust and supply-chain risk because users are encouraged to run unreviewed remote code while being reassured by language that downplays external dependencies.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: Line L14 describes the tool as only reading logs and CLI output, suggesting no persistent write side effects. Later lines explicitly state that it runs with SQLite and exposes `CLAW_INSIGHTS_DB` for the database file path, which indicates local data is being written and retained.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises transcript replay, log reading, and token/tool tracking but does not warn that these records may contain secrets, prompts, internal data, or personal information. Storing and surfacing this data in a dashboard increases exposure if the host is shared, compromised, or screenshots/API outputs are shared onward.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The install instructions tell users to pipe a downloaded script directly into the shell without any integrity verification or warning. If the hosting domain, transport, CDN, or upstream script is compromised, arbitrary code will execute immediately on the user's machine.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill provides a `--no-auth` option without warning users that disabling authentication can expose the dashboard and API to unauthorized access, especially if bound beyond localhost or used on a multi-user system. Given the product stores session transcripts and metrics, unauthorized access could reveal sensitive operational data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly exposes a `CLAW_INSIGHTS_NO_AUTH` option that disables authentication entirely, but it does so without a clear warning that this can expose sensitive observability data, session transcripts, and operational metadata to any local or network-accessible user depending on bind configuration. In the context of an observability dashboard for agent activity, this is particularly risky because the product may surface transcripts, tokens, logs, and system details that materially increase the impact of unauthorized access.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Test token against an authenticated endpoint
TOKEN="${CLAW_INSIGHTS_API_TOKEN:-$(cat ~/.claw-insights/auth-secret 2>/dev/null)}"
curl -s -o /dev/null -w "%{http_code}" \
  -X POST http://127.0.0.1:41041/api/snapshot \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**Diagnosis:**

```bash
ls -la ~/.claw-insights/metrics.db
```

**Fix:**

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Fix:**

- Ensure the user running claw-insights has read/write access
- Or set a custom path: `CLAW_INSIGHTS_DB=/path/to/writable/metrics.db`

### Database Corruption

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.