Security audit

Outclaw Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup skill is mostly purpose-aligned for an outreach assistant, but it asks for broad account-connection, plugin-installation, local persistence, and URL-fetching authority without enough scoping or consent gates.

Review this skill carefully before installing. Only use it if you are comfortable letting it connect business communication accounts, install third-party outreach plugins, store profile/company data locally, fetch and retain website content, and optionally schedule recurring prospecting jobs. Prefer approving each integration one at a time, avoid pasting full OAuth callback URLs into chat, and verify plugin sources and permissions before authentication.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:239
Finding: Unpinned and Unverified Third-Party Plugin Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:239-252; additional affected installation flow in references/plugin-connect.md:134-145
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

SKILL.md:239-252:

markdown
| Plugin | Install | |--------|---------| | Gmail / Outlook / IMAP | `marlinjai/email-mcp` | | Google Calendar | `nspady/google-calendar-mcp` | | Twitter / X | `nirholas/XActions` | | Bluesky | `brianellin/bsky-mcp-server` | | Instagram | `mcpware/instagram-mcp` | | WhatsApp | `jlucaso1/whatsapp-mcp-ts` | | Telegram | `chigwell/telegram-mcp` | | Slack | `korotovsky/slack-mcp-server` | | Discord | `SaseQ/discord-mcp` | | Reddit | `Arindam200/reddit-mcp` | | iMessage / SMS (macOS) | `carterlasalle/mac_messages_mcp` | | Facebook Pages | `HagaiHen/facebook-mcp-server` | | Mastodon | build on API | | Signal | build on `AsamK/signal-cli` |

references/plugin-connect.md:134-145:

markdown
## Step 5: Additional channels (optional) "Want to reach people on more channels? Each one makes campaigns more effective." | Channel | Method | Notes | |---------|--------|-------| | LinkedIn | `openclaw plugins install arun-8687/linkedin-cli` | Connection requests, InMails, DMs | | Slack | MCP UUID `597f662f-36de-437e-836e-5a81013cbfbe` | Team DMs, internal notifications | | WhatsApp | Community MCP (self-hosted) | Guide install | | Calendly | MCP UUID `d778b2f9-25f4-42a2-87ab-dbaa896deb1b` | Scheduling link generation | | Twitter/X | ClawHub | Public engagement (follow/like/comment) | For each selected channel, the agent executes install + auth directly.

Technical Analysis

The skill instructs the agent to install and authenticate multiple third-party community plugins directly. The dependency references do not specify immutable versions, release digests, commit hashes, cryptographic signatures, or an audited package m ...[truncated 2237 chars]
Remediation: View remediation
Remediation Suggestions

Replace mutable repository identifiers with an audited allowlist of immutable package versions or commit hashes.

Verify cryptographic signatures or publisher-provided checksums before installation.

Maintain a lockfile or signed manifest recording the exact approved source, version, digest, runtime, and permissions for every plugin.

Require explicit user approval after presenting the plugin publisher, immutable version, requested scopes, and security implications.

Review plugin source code and transitive dependencies before adding an integration to the allowlist.

Run each plugin in a restricted sandbox with narrowly scoped filesystem, network, process, and environment-variable access.

Issue separate least-privilege credentials for each integration and request only the OAuth scopes needed for the selected feature.

Prevent plugins from reading unrelated service tokens, OpenClaw memory, or knowledge-base content.

Revalidate signatures and hashes during upgrades rather than automatically installing the newest release.

Document an incident-response process for revoking tokens and removing compromised plugins.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:92
Finding: Unrestricted User-Supplied URL Fetching Enables Server-Side Request Forgery and Persistent Untrusted Content Ingestion
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:92-108
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

markdown
**2c. web_fetch the website into raw/.** For the URL U: ```bash SHARED=~/.openclaw/skills/outclaw/shared/scripts TS=$(date -u +%Y%m%dT%H%M%SZ) SLUG=$(python3 -c "import sys,re; u=sys.argv[1]; print(re.sub(r'[^a-z0-9]+','-',u.lower().split('://',1)[-1].split('/',1)[0]).strip('-'))" "$U") # Use web_fetch MCP tool OR curl (prefer web_fetch if available) # Persist root page + any /about, /product, /solutions, /pricing, /customers # the agent can surface from the homepage's nav: for p in "" /about /company /product /products /solutions /pricing /customers /case-studies; do out=~/.openclaw/outclaw/kb/raw/${SLUG}-website${p//\//-}-$TS.md # agent: use web_fetch tool here — it beats curl for JS-rendered content. # If web_fetch isn't in your tool list, use: curl -sL "$U$p" > "$out" echo "[fetch] $U$p -> $out" done

text
### Technical Analysis The URL is supplied by the user and is used as the base for several network requests. The documented flow does not validate: - The URL scheme. - The resolved destination address. - Whether the destination is loopback, link-local, private, multicast, or otherwise internal. - Redirect destinations. - Ports. - Response content type or maximum response size. - Whether DNS resolution changes between validation and connection. The fallback command uses `curl -sL`; the `-L` option follows redirects. Therefore, even an initially public URL can redirect the request to a private service. Appending paths does not prevent exploitation because the root request is included and internal services may respond on the appended paths as well. Responses are saved persistently under `~/.openclaw/outclaw/kb/raw/` and subsequently read to construct trusted organization knowledge. This creates two relate ...[truncated 2275 chars]
Remediation: View remediation
Remediation Suggestions

Accept only normalized https:// URLs, with http:// allowed only when explicitly required.

Reject URLs containing embedded credentials, ambiguous host encodings, unsupported schemes, or unexpected ports.

Resolve the hostname before connecting and reject loopback, link-local, private, carrier-grade NAT, multicast, reserved, and unspecified IPv4 and IPv6 ranges.

Apply the same scheme, hostname, port, DNS, and IP-range validation after every redirect; preferably disable redirects by default.

Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection.

Explicitly block common cloud metadata destinations and metadata hostnames.

Run the fetcher in a network sandbox that cannot reach localhost, private networks, metadata endpoints, or unrelated internal services.

Configure strict connection and total timeouts, response-size limits, redirect limits, and accepted content types.

Store fetched content as untrusted data and sanitize active or instruction-like content before downstream processing.

Ensure downstream prompts clearly delimit website text and instruct the model never to follow commands contained in fetched material.

Require user confirmation before persisting content from a hostname different from the originally supplied company domain.

Avoid retaining raw sensitive responses indefinitely; apply access controls, retention limits, and secure deletion.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad, natural phrases like 'set up outreach', 'connect my channels', and 'learn my style' that could match ordinary user requests and cause this high-impact setup workflow to run unintentionally. In this skill, unintended invocation is especially risky because the flow proceeds to plugin inventory, account connection, local persistence, and possible environment changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs the agent to run plugin installation and authentication commands itself, rather than merely suggesting them, without a mandatory safety prompt explaining that it will modify the environment and connect external accounts. In context, this is more dangerous because the same skill also handles multiple communication channels, so an unintended or overly broad invocation could lead directly to account linkage and expanded access to email, calendar, chat, or social platforms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs fetching company websites and saving the full bodies under local raw/ storage, but does not require a clear user-facing disclosure or consent for local retention of third-party content. This creates privacy, compliance, and data-retention risk, especially if pages contain copyrighted text, contact details, or customer references that are then persisted and reused by downstream drafting skills.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
### Step 3 — Style learning (delegated to outclaw-style) Invoke the `outclaw-style` skill at `~/.openclaw/skills/outclaw/skills/outclaw-style/SKILL.md`. It: - Trains one style prompt per `ready` outreach channel - Writes to `~/.openclaw/outclaw/styles/<tenant>/<channel>_style.md`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly writes a detailed plugin inventory to persistent local storage and logs a memory entry, but the workflow text does not instruct the agent to warn the user, obtain consent, or explain retention. Inventory data can reveal installed tools, connected outreach channels, and system capabilities, which may expose sensitive operational or account information to later processes or local users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly directs the agent to execute multiple shell-based CLIs directly and to handle retries/diagnostics autonomously. In a setup skill that processes user choices, emails, API keys, and OAuth state, this broad shell authority materially increases the attack surface and can enable unintended command execution, plugin installation, or misuse of connected accounts if downstream inputs or tools are compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The flow tells remote users to paste the full OAuth callback URL into chat, which commonly contains an authorization code and related state values. Requesting that sensitive URL in chat without a warning or safer alternative risks credential interception via chat logs, other integrations, or human review systems, potentially allowing account takeover of the connected service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup flow adds Twitter/X engagement capability even though the skill metadata describes supported channels as Leadbay/LeadClaw, Gmail, Calendar, Slack, LinkedIn, WhatsApp, and Calendly. Expanding to an undeclared social channel is a scope mismatch that can grant the agent extra outreach capabilities the user and policy layer may not expect, increasing the risk of unauthorized actions or reputational harm.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file explicitly directs the system to collect and persist detailed personal and organizational information into long-lived KB files under kb/me/. Even if intended for personalization, storing rich profile, employment history, public presence, ICP, pricing, and case-study data increases privacy exposure and the blast radius of any later unauthorized access or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions direct the agent to inspect gog auth list and derive identity information from the primary email without clearly telling the user that account-identifying data will be accessed. This creates a privacy and consent issue because the skill silently pulls personal data from a connected account to seed profile creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to call leadclaw.get_user_org() to pre-fill organization data without an explicit privacy notice or consent checkpoint. Pulling organization and taste-profile data from an integration can expose sensitive business context and may surprise users if done implicitly during setup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown defines skill activation on phrases like "Update my profile" and "my role changed" without narrowing the product context or providing exclusion conditions. These are common utterances that could appear in unrelated conversations, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Vague Triggers

Missing User Warnings

Missing User Warnings

Skill Enumeration

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Context-Inappropriate Capability

Ssd 3

Missing User Warnings

Missing User Warnings

Vague Triggers

Static analysis