ClawHub
Back to skill

Security audit

data-analysis

Security checks for vulnerabilities and agentic risk

Overview

This is a data-analysis guidance skill with no executable payload or hidden runtime behavior, though its README has imperfect manual installation guidance.

Prefer installing the reviewed ClawHub package directly. Avoid following the external setup guide or cloning the GitHub repository unless you verify the source, version, and contents first, because those routes could change independently of this reviewed package.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Mutable Third-Party Installation Sources Create a Skill Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 9–19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
> 📖 **Complete setup guide**: https://skillboss.co/skill.md

### Via ClawHub
```bash
clawhub install modesty-data-analysis

Manual Installation

bash
git clone https://github.com/ModestyRichards/data-analysis.git
cp -r data-analysis ~/.openclaw/skills/data-analysis
text

### Technical Analysis

The installation documentation directs users to an external setup guide hosted on an unrelated domain and permits manual installation from a mutable Git repository reference. The Git command does not pin an immutable commit or verified release, and no checksum or signature verification is required before the downloaded content is copied into the active OpenClaw Skill directory.

Consequently, the material installed by a user at a later date may differ from the package reviewed during this audit. Compromise of the external domain, GitHub account, repository, or default branch could allow altered Skill instructions or executable files to be distributed without changing the audited artifact.

The README also uses inconsistent installation identifiers: `data-analysis` for one installation method and `modesty-data-analysis` for another. This ambiguity can increase the chance that users install a different or unintended package.

No malicious payload, automatic download behavior, or automatic code execution was found in the audited project. Exploitation requires a user or automation system to follow the documented installation steps.

### Attack Path

1. An attacker compromises the external setup domain, GitHub repository, repository owner account, or another mutable upstream distribution source.
2. The attacker replaces or modifies the upstream Skill content with malicious instructions or executable files.
3. A user follows the RE
...[truncated 1237 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the external setup-guide dependency or place the complete installation documentation inside the audited repository.
  2. Pin manual installation to an immutable commit hash or cryptographically signed release tag rather than cloning the mutable default branch.
  3. Publish SHA-256 checksums or signed manifests for release artifacts and require verification before installation.
  4. Use one canonical Skill identifier consistently across OpenClaw, ClawHub, repository, and manual installation instructions.
  5. Prefer a trusted registry release that is explicitly associated with the reviewed project version.
  6. Document the expected repository owner, release version, commit hash, and verification procedure.
  7. Avoid copying unverified repository contents directly into an active Skill directory. Download and validate them in a staging location first.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
- Store credentials or raw exports in hidden local memory files.
- Create or depend on local folder systems for persistence.
- Create automations or background jobs without explicit user confirmation.
- Rewrite its own instruction source files.

## Related Skills
Install with `clawhub install <slug>` if user confirms:

Static analysis

No suspicious patterns detected.