Security audit

Agenthub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a paid API gateway, but it needs review because it uses a wallet key, installs third-party code, and gives broad paid actions through unsafe call instructions.

Review this carefully before installing. Use only a dedicated low-balance wallet, assume every API call may cost money, avoid sending secrets or proprietary code through code_exec, confirm email sends manually, and do not use the documented shell snippet as-is until the SDK install and temporary-script pattern are hardened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:51
Finding: Unaudited Third-Party Dependency Receives a Wallet Private Key
Content: View full analysis
/tmp/agenthub-call.mjs << SCRIPT import AgentHub from "$HOME/.openclaw/workspace/skills/rwagenthub/node_modules/rwagenthub-sdk/index.js"; const hub = new AgentHub({ privateKey: process.env.AGENTHUB_WALLET_KEY }); const result = await hub.call('API_NAME', { ...inputs... }); ``` ### Technical Analysis The Skill automatically installs `rwagenthub-sdk` from the npm registry and then gives the installed package direct access to `AGENTHUB_WALLET_KEY`, a wallet credential capable of signing USDC payment authorizations. Although the package version is pinned to `1.0.2`, the audited project does not include the dependency source, a lockfile, an expected package integrity hash, or verifiable provenance information. Consequently, the claims in `SKILL.md` concerning the dependency's behavior cannot be independently verified from the supplied project. The installation command also does not disable npm lifecycle scripts. If the published package or one of its transitive dependencies contains an installation script, that script may execute during installation under the Agent's operating-system account. At runtime, the package necessarily operates in a process containing the wallet key and can read or transmit it. This is a supply-chain exposure rather than proof that the referenced package is malicious. ### Attack Path 1. An attacker compromises the npm package, a transitive dependency, a publisher account, or the dependency delivery path. 2. The Agent executes the documented automatic installation command. 3. Malicious code executes through an npm lifecycle script or when ...[truncated 844 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:64
Finding: Shell Command Injection Through an Unquoted Heredoc
Content: View full analysis
/tmp/agenthub-call.mjs << SCRIPT import AgentHub from "$HOME/.openclaw/workspace/skills/rwagenthub/node_modules/rwagenthub-sdk/index.js"; const hub = new AgentHub({ privateKey: process.env.AGENTHUB_WALLET_KEY }); const result = await hub.call('API_NAME', { ...inputs... }); console.log(JSON.stringify(result, null, 2)); SCRIPT node /tmp/agenthub-call.mjs ``` ### Technical Analysis The heredoc delimiter `SCRIPT` is unquoted. Shells therefore perform expansions on the heredoc body before writing it to `/tmp/agenthub-call.mjs`, including command substitution using `$(...)` or backticks, parameter expansion, and backslash processing. The instructions require replacing `{ ...inputs... }` with parameters for the selected API. Many supported parameters can contain user-controlled or externally sourced strings, including web-search queries, URLs, email subjects and bodies, extraction prompts, and code. If such a value is inserted directly into the prescribed heredoc, shell metacharacters can be interpreted before Node.js starts. For example, a user-supplied string containing `$(id)` could cause the shell to execute `id` while generating the JavaScript file. JavaScript quoting does not prevent this because shell expansion occurs before JavaScript parsing. ### Attack Path 1. An attacker supplies an API parameter containing shell command substitution, such as a search query, prompt, email body, URL, or code string containing `$(attacker_command)`. 2. The Agent places that value into `{ ...inputs... }` as directed by the Skill. 3. The Agent executes the unquoted heredoc. 4. The shell evaluates the attacker's command substitution while constructing `/tmp/agenthub-call.mjs`. 5. The injected command runs with the privileges and environment of the Agent. 6. The command may read `AGENTHUB_WALLET ...[truncated 697 chars]
Remediation: View remediation
"$SCRIPT_PATH" <<'SCRIPT' ``` 2. Do not interpolate API names or parameters into shell-generated JavaScript source. 3. Serialize dynamic inputs with a trusted JSON serializer and pass them through a dedicated JSON file or standard input. 4. Validate API names against a fixed allowlist. 5. Parse the parameter payload using `JSON.parse` inside the Node.js process. 6. Avoid placing untrusted data in environment variables where size limits or accidental process exposure may create additional risks. 7. Apply schema validation to every API parameter before dispatch. 8. Run the Node.js process with minimal filesystem and environment access so that any remaining injection defect has a restricted impact. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:67
Finding: Predictable Shared Temporary Script Enables File-Race Attacks
Content: View full analysis
/tmp/agenthub-call.mjs << SCRIPT import AgentHub from "$HOME/.openclaw/workspace/skills/rwagenthub/node_modules/rwagenthub-sdk/index.js"; const hub = new AgentHub({ privateKey: process.env.AGENTHUB_WALLET_KEY }); const result = await hub.call('API_NAME', { ...inputs... }); console.log(JSON.stringify(result, null, 2)); SCRIPT node /tmp/agenthub-call.mjs ``` ### Technical Analysis The Skill always writes and executes `/tmp/agenthub-call.mjs`. This path is predictable and resides in a directory commonly shared by multiple local users and processes. The instructions do not create the file exclusively, verify that it is a regular file owned by the current user, set restrictive permissions, or prevent replacement between writing and execution. This creates several potential local attack conditions: - A pre-created symbolic link may redirect the write to another path where host protections do not prevent it. - Another process may replace the script after the heredoc finishes but before Node.js opens it. - Concurrent Skill calls may overwrite one another's scripts and execute incorrect content. - Generated API inputs may remain readable in the temporary file after execution. The practical feasibility of symlink-based attacks depends on operating-system protections and filesystem permissions, but the replacement and concurrency risks arise from the fixed shared pathname itself. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/agenthub-call.mjs`. 2. The attacker prepares a conflicting file or repeatedly replaces the path. 3. The Agent writes the script and subsequently invokes Node.js using the same predictable pathname. 4. During the interval between creation and execution, the attacker replaces the file with malicious JavaScript, or concurrent calls ...[truncated 701 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill offers a code_exec API that runs supplied code on an external service, but it lacks a clear warning that code and embedded secrets or data will be transmitted off-host for remote execution. In a general agent skill, this is dangerous because users may assume local execution and inadvertently send sensitive code, credentials, or proprietary data to an untrusted third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes an email_send capability that transmits recipient addresses, subject lines, and message bodies to an external service, but it does not provide an explicit privacy/security warning or require clear user confirmation before sending. This can lead to accidental disclosure of sensitive data or unauthorized outbound communication, especially because the skill is user-invocable and framed as a general-purpose API gateway.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.