Clawhub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:49 AM UTC
• Version: 1.5.8

Overview

This skill is coherent, but it should be reviewed because it installs and runs a native OctoFlow binary and its examples can grant broad local file access.

Install only if you trust the OctoFlow release source and verify the exact platform artifact hash before use. Prefer exact --allow-read and --allow-write paths or a dedicated task directory instead of granting access to ., and use --no-memory if you do not want local preferences or corrections saved. Be deliberate before enabling the MCP server because it makes OctoFlow available as a long-running agent tool.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15
• Finding: External Native Executables Are Downloaded and Executed Without Independent Authenticity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 15–22 and 193–199 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: emoji: "\U0001F419" requires: anyBins: - octoflow install: - id: github-release kind: download url: https://github.com/octoflow-lang/octoflow/releases/download/v1.5.8/ bins: [octoflow] label: "Download OctoFlow v1.5.8 from GitHub Releases (4.5 MB, zero dependencies)" ``` ```markdown | Platform | File | SHA-256 | |----------|------|---------| | Windows x64 | [octoflow-v1.5.8-x86_64-windows.zip](https://github.com/octoflow-lang/octoflow/releases/download/v1.5.8/octoflow-v1.5.8-x86_64-windows.zip) | `2b26049565a2bfd2b1c4a1c103f2a64cd864dd14da619bd7be750ad3c6b356f2` | | Linux x64 | [octoflow-v1.5.8-x86_64-linux.tar.gz](https://github.com/octoflow-lang/octoflow/releases/download/v1.5.8/octoflow-v1.5.8-x86_64-linux.tar.gz) | `d7306fc1f5a9a733a66ae3a4d5f3b145670efa7a079302935d867b4b75551845` | | macOS (Apple Silicon) | [octoflow-v1.5.8-aarch64-macos.tar.gz](https://github.com/octoflow-lang/octoflow/releases/download/v1.5.8/octoflow-v1.5.8-aarch64-macos.tar.gz) | `33808c330dc5f08eb0008b52ecfb5f0ea532fb71b1c6996075c09b33dc5d8fd2` | Verify: `sha256sum octoflow-v1.5.8-*` (full checksums in [SHA256SUMS.txt](https://github.com/octoflow-lang/octoflow/releases/download/v1.5.8/SHA256SUMS.txt)). ``` ### Technical Analysis The Skill's declared functionality requires an external native OctoFlow executable. The installation metadata instructs the host to download this executable from a GitHub release under the publisher's account. Because the binary is not included in the audited project, its implementation and the documented sandbox, telemetry, storage, and network restrictions cannot be verified through this audit. SHA-256 hashes reduce accide ...[truncated 2475 chars]
• Remediation: ## Remediation Suggestions 1. Change automated installation metadata to use an immutable, platform-specific artifact URL rather than a release directory. 2. Require verification of every downloaded artifact before extraction or execution. Installation must fail closed on any verification error. 3. Sign release artifacts with Sigstore, minisign, or an equivalent mechanism and pin the expected signing identity or public key independently of the release repository. 4. Publish provenance attestations covering the source revision, build workflow, build environment, and resulting artifact digest. 5. Provide source code and reproducible-build instructions so users can independently validate that release binaries correspond to reviewed source. 6. Keep trusted hashes or signing-key fingerprints in a separately controlled and reviewed channel instead of relying only on a checksum file hosted alongside the binaries. 7. Document that the downloaded binary is native code running with the user's ambient privileges and that its internal sandbox does not sandbox the executable itself. 8. Consider distributing through a package ecosystem that supports signed metadata, immutable versions, and transparent provenance verification.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:133
• Finding: Examples Grant Unnecessarily Broad Access to the Entire Working Directory## Vulnerability Details **File Location**: `SKILL.md`, lines 133–152 **Vulnerability Type**: Excessive filesystem permissions **Risk Level**: Medium ### Vulnerable Code ```markdown ### Data Analysis ```bash # User: "analyze sales.csv and show trends" octoflow chat "load sales.csv, compute monthly averages, and plot the trend" --allow-read=. ``` ### GPU Compute ```bash # User: "sort a large dataset on GPU" octoflow chat "generate 1M random numbers on GPU and sort them" ``` ### Machine Learning ```bash # User: "cluster my customers" octoflow chat "load customers.csv, run K-means with 5 clusters, print cluster sizes" --allow-read=. ``` ### Image Processing ```bash # User: "blur this photo" octoflow chat "load photo.bmp, apply gaussian blur, save as blurred.bmp" --allow-read=. --allow-write=. ``` ``` ### Technical Analysis The examples grant read access to the entire current working directory with `--allow-read=.` and, for image processing, grant write access to the entire directory with `--allow-write=.`. The demonstrated operations only require access to individual input files and a specific output file or dedicated output directory. These examples exceed minimum privilege and conflict with the Skill's stated Deno-style, opt-in security model. Agents and users commonly copy documented commands directly. If OctoFlow-generated code is incorrect, adversarially influenced, or the executable is compromised, directory-wide access increases the available data and modification scope. The issue does not independently escape operating-system access controls. It widens OctoFlow's application-level sandbox from the required files to every accessible path under the current working directory. ### Attack Path 1. A user asks the agent to analyze a CSV file, train a model, or process an image. 2. The agent follows the documented pattern and invokes OctoFlow with `--allow-read=.` or `--allow-write=.`. 3 ...[truncated 1165 chars]
• Remediation: ## Remediation Suggestions 1. Replace directory-wide read permissions with exact input paths: - `--allow-read=./sales.csv` - `--allow-read=./customers.csv` - `--allow-read=./photo.bmp` 2. Replace directory-wide write permissions with an exact output file or a dedicated output directory: - `--allow-write=./blurred.bmp` - `--allow-write=./output` 3. Run OctoFlow from a dedicated workspace containing only files required for the task. 4. Instruct agents to derive permission scopes from the user's explicit inputs and outputs rather than defaulting to the current directory. 5. Require separate confirmation before expanding permissions from a named file to a directory. 6. Add guidance warning that `.` may contain unrelated sensitive material and should not be used unless the entire directory is intentionally in scope. 7. If exact output-file permission is unsupported, create a task-specific empty output directory and grant write access only to that directory.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to capture many generic analytics and plotting requests, which could cause the agent to invoke this skill even when the user did not specifically want a GPU/Vulkan-based tool. Over-broad routing increases the chance of unnecessary execution of a downloaded binary or use of a more privileged external tool than intended, creating avoidable exposure and reducing user-choice fidelity.

Static analysis

No suspicious patterns detected.