Claw Insights Install

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:20 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate local observability setup guide, but it should be reviewed because it recommends unverified remote code execution and handles sensitive local OpenClaw session data.

Install only if you trust the `claw-insights` publisher and are comfortable with a local dashboard reading OpenClaw transcripts, logs, cron metadata, and storing metrics. Prefer a pinned, verifiable package or inspected installer over `curl | sh`, keep authentication enabled, bind to localhost or a protected tunnel, and avoid sharing snapshots or API output that may reveal private session content.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–24 and 48–52
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

# One-line install (recommended)
curl -fsSL https://claw-insights.com/install.sh | sh

bash

npm update -g claw-insights
# Or re-run the install script
curl -fsSL https://claw-insights.com/install.sh | sh

Technical Analysis

The documented installation and upgrade procedures pipe an HTTP response directly into sh. The downloaded script is not pinned to a version, saved for inspection, checked against a cryptographic hash, or validated using a digital signature.

This creates a mutable code-execution channel: the effective code executed by the Skill can change after the Skill itself has been reviewed. Compromise of the external domain, hosting environment, publication process, DNS infrastructure, or TLS termination could cause attacker-controlled shell commands to be returned and executed.

Arbitrary remote shell execution exceeds the minimum privileges necessary to install a known application artifact. A versioned, integrity-verified package or release archive would provide the required installation functionality with a substantially smaller trust boundary.

The external installer was not included in the audited project. Its current contents and the claims that the application is read-only, makes no cloud calls, and keeps data local therefore could not be independently verified.

Attack Path

1. An attacker compromises or otherwise gains control of https://claw-insights.com/install.sh or its delivery infrastructure.
2. The attacker changes the response to include malicious shell commands.
3. A user or agent follows the documented installation or upgrade procedure.
4. curl retrieves the attacker-controlled response and passes it directly to sh.
5. The commands execute immediately with the permissi ...[truncated 823 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl ... | sh installation and upgrade instructions.
• Publish immutable, versioned release artifacts through a verifiable official channel.
• Pin installation instructions to a specific audited version rather than retrieving a mutable script.
• Publish a SHA-256 or stronger checksum over the exact artifact and preferably sign releases with a documented cryptographic signing key.
• Require users to download the installer to a local file, verify its signature and checksum, and inspect it before execution.
• Ensure the installer refuses elevated execution unless a narrowly scoped privileged operation is strictly necessary.
• Document every filesystem location, service, and permission modified by installation.
• Prefer an installer that operates entirely under the invoking user's account and grants access only to the specific OpenClaw files required for observability.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Unpinned Global npm Installation and Upgrade Expose a Supply-Chain Execution Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–27 and 48–50
Vulnerability Type: Insecure third-party dependency installation
Risk Level: High

Vulnerable Code

bash

# Or via npm
npm install -g claw-insights

bash

npm update -g claw-insights

Technical Analysis

The installation command does not specify an exact package version, integrity value, lockfile, or verified provenance. The upgrade command likewise resolves a package version from the registry at execution time.

npm packages may execute lifecycle scripts during installation or upgrade. Therefore, a compromised maintainer account, malicious package release, registry incident, or compromised dependency could result in arbitrary code execution. Global installation increases the package's reach in the user's environment and may expose globally writable or shared executable paths, depending on npm configuration.

The npm package and its dependency graph were not included in the audited artifact, so their implementation, lifecycle scripts, provenance, and transitive dependencies could not be reviewed.

Attack Path

1. An attacker compromises the claw-insights npm publication account, release process, package contents, or a dependency resolved by the package.
2. The attacker publishes a malicious version or introduces malicious lifecycle behavior.
3. A user follows npm install -g claw-insights, or later runs npm update -g claw-insights.
4. npm resolves and downloads the unpinned or newly published package content.
5. Any applicable lifecycle scripts execute with the permissions of the invoking account.
6. The malicious package can access user files, application data, environment variables, and other resources available to that account.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the invoking user's account. Potentially accessible information includes OpenClaw t ...[truncated 350 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation to an exact reviewed version, such as claw-insights@X.Y.Z.
• Publish and document package provenance, release signatures, and integrity information.
• Audit the package's lifecycle scripts and transitive dependency graph before recommending installation.
• Avoid global installation where possible; use a dedicated, unprivileged application directory or isolated runtime account.
• Do not invoke npm with sudo or another privileged account.
• Disable lifecycle scripts during installation when they are not required, and document any scripts that must run.
• Replace unrestricted npm update -g guidance with an explicit process that selects, reviews, and verifies a specific target version.
• Add release pinning and dependency-locking controls so package behavior cannot change independently of the reviewed instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is direct external script fetching and execution from a remote domain. It is dangerous because it grants immediate shell execution to code that can change over time and may be compromised independently of the published skill content.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# One-line install (recommended)
curl -fsSL https://claw-insights.com/install.sh | sh

# Or via npm
npm install -g claw-insights

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh chain is a classic unsafe execution pattern because it turns downloaded content directly into shell commands without inspection. This materially increases the danger of any network, hosting, or script compromise and is especially risky in a skill intended to be followed verbatim.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# One-line install (recommended)
curl -fsSL https://claw-insights.com/install.sh | sh

# Or via npm
npm install -g claw-insights

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Although the location spans nearby benign curl usage, the flagged content includes the upgrade step that again fetches and executes a remote installer script. Reintroducing the same unsafe pattern during upgrades compounds supply-chain risk across the product lifecycle.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Verify

bash

curl http://127.0.0.1:41041/health
# → {"status":"ok",...}

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using | sh in the upgrade path has the same arbitrary-code-execution risk as in installation and may be even more likely to be run routinely without scrutiny. This creates an ongoing remote execution channel if the upstream script is altered maliciously.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash

npm update -g claw-insights
# Or re-run the install script
curl -fsSL https://claw-insights.com/install.sh | sh

Quick Config

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill strongly markets the tool as local-only and zero-cloud, yet the recommended install and upgrade path downloads and executes a remote script from the network. This creates a trust and supply-chain risk because users are encouraged to run unreviewed remote code while being reassured by language that downplays external dependencies.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L14 describes the tool as only reading logs and CLI output, suggesting no persistent write side effects. Later lines explicitly state that it runs with SQLite and exposes CLAW_INSIGHTS_DB for the database file path, which indicates local data is being written and retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises transcript replay, log reading, and token/tool tracking but does not warn that these records may contain secrets, prompts, internal data, or personal information. Storing and surfacing this data in a dashboard increases exposure if the host is shared, compromised, or screenshots/API outputs are shared onward.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install instructions tell users to pipe a downloaded script directly into the shell without any integrity verification or warning. If the hosting domain, transport, CDN, or upstream script is compromised, arbitrary code will execute immediately on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill provides a --no-auth option without warning users that disabling authentication can expose the dashboard and API to unauthorized access, especially if bound beyond localhost or used on a multi-user system. Given the product stores session transcripts and metrics, unauthorized access could reveal sensitive operational data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly exposes a CLAW_INSIGHTS_NO_AUTH option that disables authentication entirely, but it does so without a clear warning that this can expose sensitive observability data, session transcripts, and operational metadata to any local or network-accessible user depending on bind configuration. In the context of an observability dashboard for agent activity, this is particularly risky because the product may surface transcripts, tokens, logs, and system details that materially increase the impact of unauthorized access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 62)May include surrounding context.

md

# Test token against an authenticated endpoint
TOKEN="${CLAW_INSIGHTS_API_TOKEN:-$(cat ~/.claw-insights/auth-secret 2>/dev/null)}"
curl -s -o /dev/null -w "%{http_code}" \
  -X POST http://127.0.0.1:41041/api/snapshot \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/troubleshooting.md (reported line 95)May include surrounding context.

Diagnosis:

bash

ls -la ~/.claw-insights/metrics.db

Fix:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 100)May include surrounding context.

md

**Fix:**

- Ensure the user running claw-insights has read/write access
- Or set a custom path: `CLAW_INSIGHTS_DB=/path/to/writable/metrics.db`

### Database Corruption