ClawHub
Back to skill

Security audit

Hrflow

Security checks for vulnerabilities and agentic risk

Overview

This HR automation skill is not malware, but it asks for broad HR, payroll, and messaging access without enough enforced scoping or per-action control.

Install only with test or narrowly scoped credentials at first. Do not expose production HRIS, payroll, Slack, SendGrid, or DocuSign secrets unless you have endpoint limits, read-only defaults, human approval for writes, redacted logs, and a clear audit process outside the skill.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:5
Finding

Overbroad Credential and Integration Access Requirements

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:118-139
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml
metadata:
  {"openclaw":{"requires":{"env":["HRIS_API_KEY","PAYROLL_API_KEY","SLACK_WEBHOOK_URL"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🚀"}}
bash
# HRIS System Authentication
export HRIS_API_KEY="your-workday-or-bamboohr-api-key"
export HRIS_SYSTEM="workday"  # Options: workday, bamboohr, namely, custom
export HRIS_TENANT_ID="your-tenant-id"

# Payroll System Authentication
export PAYROLL_API_KEY="your-gusto-or-adp-api-key"
export PAYROLL_SYSTEM="gusto"  # Options: gusto, adp, paychex, square

# Communication Channels
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
export SLACK_DEFAULT_CHANNEL="#hr-alerts"
export SENDGRID_API_KEY="your-sendgrid-key"  # For email

# Document Signing
export DOCUSIGN_API_KEY="your-docusign-integration-key"
export DOCUSIGN_ACCOUNT_ID="your-account-id"

# Security & Compliance
export ENCRYPTION_KEY="your-256-bit-encryption-key"
export AUDIT_LOG_RETENTION_DAYS="2555"  # 7 years
export DATA_RESIDENCY="us-east-1"  # GDPR/compliance region

Technical Analysis

The skill declares access to production-sensitive HRIS, payroll, and Slack credentials while also requiring the general-purpose network utility curl. The package contains only SKILL.md; it provides no implementation that demonstrates why these credentials are necessary, restricts the permitted API endpoints, limits credential scopes, or enforces approval before external side effects.

The broader configuration instructions also solicit SendGrid, DocuSign, and encryption credentials. Because the documented workflows involve employee records, payroll data, account provisioning, communication channels, document signing ...[truncated 2293 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove credential requirements from package metadata until an auditable implementation that needs them is included.
  2. Replace broad API keys with short-lived OAuth tokens limited to the minimum service, tenant, resource, and operation scopes.
  3. Use read-only credentials by default and request temporary write authorization only for a specific approved operation.
  4. Introduce explicit endpoint and HTTP-method allowlists rather than granting unrestricted network access through general-purpose curl.
  5. Require human confirmation before payroll modifications, HR record changes, account provisioning, purchases, document signing, or disclosure of employee PII.
  6. Implement a dry-run mode that displays intended API calls and redacted changes before execution.
  7. Retrieve secrets from a managed secret store at operation time rather than placing them broadly in the agent process environment.
  8. Prevent credentials and sensitive employee fields from appearing in prompts, command output, logs, error messages, or generated reports.
  9. Document the exact minimum scopes required for every integration and provide separate development, test, and production configurations.
  10. Add an auditable implementation with input validation, authorization checks, rate limits, immutable operation logs, and tests proving that unapproved write operations are rejected.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
_WEBHOOK_URL"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🚀"}}

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is broadly worded around common HR automation needs ('streamline employee processes', 'reduce manual HR tasks', 'personalize employee experiences'), which can cause over-triggering in unrelated conversations. Because this skill handles highly sensitive HR, payroll, and PII workflows, accidental activation could expose or act on employee data in contexts where the user did not explicitly request this capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.