ClawHub
Back to skill

Security audit

ClawLodge

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent, but it can install third-party workspaces as new agents from registry metadata without requiring a full content review first.

Before installing, pin or verify the clawlodge-cli package when possible, disable telemetry if desired, and do not let the agent install a registry workspace as a new OpenClaw agent until the downloaded contents, publisher, version, scripts, and instructions have been reviewed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 7-9
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
npm install -g clawlodge-cli

Technical Analysis

The installation instructions retrieve the current version of clawlodge-cli from the npm registry without specifying an audited version or verifying package integrity. The -g option installs the package globally, increasing its reach beyond this project.

The audited project contains only documentation and does not include the CLI source, a lockfile, a checksum, or a signature against which the downloaded package can be verified. Consequently, the executable implementation and npm lifecycle scripts are outside the reviewed artifact and may change after this Skill has been audited.

This is a supply-chain trust issue rather than evidence that the current package is malicious. However, if the npm account, package, or distribution infrastructure were compromised, following this instruction could execute attacker-controlled installation code with the permissions of the user running npm.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, or its publication process.
  2. The attacker publishes a modified release under the expected package name.
  3. A user follows the documented unpinned installation command.
  4. npm resolves and downloads the compromised current release.
  5. Malicious lifecycle scripts or CLI code execute under the installing user's account.
  6. The malicious package can access resources available to that account and persist as a globally available executable.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user who runs npm. Potentially exposed resources include user-readable files, environment variables, OpenClaw configuration, locally stored CLI credentials, and network ser ...[truncated 339 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specific reviewed version, for example:
    bash
    npm install -g clawlodge-cli@<reviewed-version>
  2. Publish and document the expected package integrity hash or a verifiable release signature.
  3. Link to the authoritative source repository and release corresponding to the pinned package version.
  4. Prefer a project-local, lockfile-controlled dependency or an ephemeral invocation over global installation where feasible.
  5. Advise users not to run npm with elevated privileges.
  6. Review npm lifecycle scripts and the distributed package contents before recommending a new version.
  7. Establish a release process using protected maintainer accounts, multi-factor authentication, provenance attestations, and reproducible build artifacts.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:258
Finding

Registry Workspace Installed as an Agent Without Mandatory Content Review

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 258-266
Vulnerability Type: Installation of unreviewed third-party agent content
Risk Level: Medium

Vulnerable Code

markdown
## Install into a new agent

When the user wants to try a workspace without disturbing the current setup, prefer the dedicated `install` command.

Preferred sequence:

1. Confirm the candidate with `clawlodge show <slug>`.
2. Run `clawlodge install <slug> --agent <name>`.
3. Report the new agent name, workspace path, zip path, and any setup prerequisites.

Technical Analysis

The prescribed workflow moves directly from metadata inspection with clawlodge show to installation as a new OpenClaw agent. Elsewhere in the Skill, show is explicitly characterized as a metadata command. Metadata such as name, author, tags, versions, and file lists does not establish that the workspace's instructions, workflows, configuration, or executable content are safe.

A published workspace is a third-party dependency whose contents may be controlled by an external publisher. Installing it as an agent can place untrusted instructions or configuration into a context where they may influence later agent behavior. Creating an isolated agent is safer than replacing the active workspace, but isolation alone does not verify package integrity, publisher trust, or the behavior of included files.

No malicious registry package is included in the audited project, and no automatic installation occurs merely by loading this Skill. The risk arises when the documented workflow is followed for an attacker-controlled or compromised registry package.

Attack Path

  1. An attacker publishes a workspace with a convincing name, description, tags, or source metadata.
  2. The workspace appears in a role-based or keyword-based ClawLodge search.
  3. The agent selects it based on registry metadata and runs clawlodge show.
  4. Because ...[truncated 1012 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the direct show-to-install workflow with a staged review process:
    • Confirm the exact slug, publisher, source repository, and immutable version.
    • Download the package to a fresh task-specific directory.
    • Verify a registry-provided checksum or cryptographic signature.
    • Extract it without executing package-provided code.
    • Inspect all Skill instructions, workflows, scripts, manifests, hooks, and configuration files.
  2. Explicitly check for network access, credential use, shell execution, filesystem writes, persistence behavior, and instructions that alter agent safety constraints.
  3. Present the user with the selected immutable version, publisher identity, requested capabilities, external destinations, and material setup steps before installation.
  4. Require explicit confirmation after the content and permissions have been reviewed.
  5. Create the new agent with minimal tools, no inherited secrets, restricted filesystem access, and network access limited to destinations necessary for its declared function.
  6. Do not automatically execute setup scripts or install package dependencies during inspection.
  7. Record the verified artifact digest so later installations cannot silently resolve to changed registry content.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

clawlodge help

text

Create a PAT in `https://clawlodge.com/settings`, then run:

```bash
clawlodge login

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
- `get`
- `download`

These write actions require a PAT:

- `favorite`
- `unfavorite`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md
- Treat `publish` as a write action. Do not run it unless the user clearly asks.
- Treat `favorite`, `comment`, and `report` as write actions. Do not run them unless the user clearly asks.
- Treat `login` as credential setup. Do not ask the user to paste tokens into shared logs.
- Prefer `show` before `download` when you are not yet sure the slug is correct.
- Prefer backup + staged extraction before any local workspace replacement.
- Never invent `get/show` flags for output directories or downloads.

Static analysis

No suspicious patterns detected.