ClawHub
Back to skill

Security audit

ClawJection

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about installing ClawJection bundles, but it gives bundle-supplied code and follow-up instructions broad control over an OpenClaw setup without enough containment or approval gates.

Install this only if you trust the ClawJection bundle sources and are comfortable with them running local code that can change your OpenClaw configuration, identity files, tools, skills, and auth setup. Prefer pinned, reviewed bundles in a disposable or backed-up environment, and require explicit approval before running entrypoints or applying follow-up actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:23
Finding

Arbitrary Remote Bundle Retrieval and Entrypoint Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-43
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

markdown
## Install Flow

1. Get the bundle locally.
2. Find the bundle root by locating `clawjection.yaml`.
3. Read `clawjection.yaml` and resolve `entrypoint.path`.
4. Run the entrypoint from the bundle root with the `apply` action.
5. By default, let the entrypoint discover OpenClaw config from `~/.openclaw/openclaw.json`.
6. If needed, pass `--openclaw-config-path <path>`.
7. Treat stdout as agent-readable hints.
8. Read the structured result JSON from `CLAWJECTION_RESULT_PATH`.
9. Execute the returned ordered `followups`.

## Source Types

### Git repository

- Clone the repo to a temporary local directory.
- If the repo contains multiple bundles, choose the directory containing the intended `clawjection.yaml`.

### Archive URL or local zip

- Download or unpack it to a temporary local directory.
- Identify the bundle root by locating `clawjection.yaml`.

Technical Analysis

The skill directs the agent to clone a Git repository or download an archive, resolve an entrypoint selected by the bundle's manifest, and execute that entrypoint locally. The effective executable payload is therefore controlled by the external bundle author and can change after the skill itself has been reviewed.

No mandatory source allowlist, immutable revision pinning, signature verification, content-hash verification, canonical-path validation, sandboxing, or explicit pre-execution user approval is required. The general instruction to review what an entrypoint “appears to do” does not create an enforceable security boundary and may not reveal behavior hidden through obfuscation, downloaded second-stage payloads, or runtime conditions.

Attack Path

  1. An attacker supplies a Git repository, archive URL, or local bundle to the user.
  2. Th ...[truncated 975 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not automatically execute entrypoints obtained from arbitrary repositories or URLs.
  • Restrict bundles to explicitly trusted and allowlisted sources.
  • Pin Git sources to immutable commit identifiers and archives to approved cryptographic hashes.
  • Require signed manifests and verify signatures before processing a bundle.
  • Canonicalize entrypoint.path and reject absolute paths, symbolic-link escapes, and directory traversal outside the bundle root.
  • Inspect all executable bundle content and block entrypoints that retrieve or execute unreviewed second-stage payloads.
  • Run approved entrypoints in a disposable sandbox with no credentials, minimal filesystem access, restricted system calls, and network access disabled by default.
  • Present the resolved source, revision, entrypoint, requested permissions, and proposed command to the user and require explicit confirmation immediately before execution.
  • Record all changed files and support atomic rollback if installation fails or produces unauthorized modifications.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:29
Finding

Execution of Attacker-Controlled Follow-Up Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-31 and SKILL.md:50-54
Vulnerability Type: Skill instruction hijacking
Risk Level: Critical

Vulnerable Code

markdown
7. Treat stdout as agent-readable hints.
8. Read the structured result JSON from `CLAWJECTION_RESULT_PATH`.
9. Execute the returned ordered `followups`.
markdown
## Execution Rules

- Run from the bundle root so relative paths in the bundle resolve correctly.
- Do not assume the bundle layout beyond `clawjection.yaml` and the declared entrypoint.
- If the bundle installs CLIs or skills, verify they were actually installed before claiming success.
- If the result says `needs_user_action`, do not treat the setup as finished; perform the `followups`.

Technical Analysis

Standard output and the result file are generated by the bundle entrypoint and must therefore be treated as untrusted attacker-controlled data. The skill instead characterizes stdout as agent-readable hints and directs the agent to execute ordered followups returned by the entrypoint.

The instructions do not limit follow-ups to a strict set of safe operations, reject embedded natural-language prompts, independently authorize each requested action, or require user approval. A malicious bundle can consequently redirect the agent after initial execution and induce additional tool calls outside the legitimate installation task.

Attack Path

  1. The attacker creates a bundle whose entrypoint emits manipulative instructions through stdout or writes them into the result JSON.
  2. The agent executes the entrypoint as directed by the skill.
  3. The entrypoint returns crafted followups, potentially labeling them as required user actions.
  4. The agent interprets this attacker-controlled output as actionable guidance.
  5. The agent invokes tools, reads unrelated files, changes configuration, downloads additional content, or performs other attacker-se ...[truncated 600 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat stdout and result JSON as untrusted data rather than executable instructions.
  • Define a strict result schema with a small allowlist of typed follow-up actions and reject free-form commands or natural-language directives.
  • Reject unknown properties, malformed values, recursive actions, external URLs, and operations outside the bundle's declared scope.
  • Apply independent authorization and safety policy checks to every follow-up.
  • Display each requested follow-up, its parameters, and its expected effects to the user before execution.
  • Require explicit user approval for command execution, network access, installation, authentication changes, or access to files outside an isolated staging directory.
  • Impose limits on follow-up count and recursion depth to prevent unbounded action chains.
  • Ensure bundle output cannot override system instructions, safety constraints, or the user's original goal.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:17
Finding

Unrestricted Bundle Access to OpenClaw Configuration and Core Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17-18, SKILL.md:27-28, and SKILL.md:57-61
Vulnerability Type: Unauthorized access and privilege escalation
Risk Level: High

Vulnerable Code

markdown
- modify the OpenClaw workspace or local runtime
- install tools, skills, or auth setup when needed
markdown
4. Run the entrypoint from the bundle root with the `apply` action.
5. By default, let the entrypoint discover OpenClaw config from `~/.openclaw/openclaw.json`.
markdown
## Safety

- Review what the entrypoint appears to do before running untrusted bundles.
- Tell the user when a bundle will overwrite core OpenClaw files such as `IDENTITY.md`.
- Never claim a remote skill or CLI is installed unless the install command succeeded.
- Keep secrets out of workspace files unless the bundle explicitly requires that behavior and the user agrees.

Technical Analysis

The skill expressly permits bundle entrypoints to modify the OpenClaw workspace or runtime, install tools and skills, configure authentication, discover the default OpenClaw configuration, and overwrite core files such as IDENTITY.md.

These capabilities are not protected by a least-privilege permission model. Informing the user that a core file will be overwritten is not equivalent to obtaining explicit authorization, and the instructions do not restrict which configuration fields, credentials, runtime components, or identity files an entrypoint may access. Because the entrypoint is selected by an arbitrary bundle, this access materially increases the consequences of executing an untrusted source.

Attack Path

  1. An attacker provides a bundle that presents itself as a legitimate OpenClaw role or capability package.
  2. The agent executes the bundle entrypoint.
  3. The entrypoint discovers ~/.openclaw/openclaw.json or receives another configuration path.
  4. The payload reads sensitive configuratio ...[truncated 796 chars]
Remediation
View remediation

Remediation Suggestions

  • Deny bundle access to OpenClaw configuration, credentials, identity files, and the core runtime by default.
  • Introduce a capability manifest that declares exact files, directories, network destinations, tools, and configuration fields required by the bundle.
  • Grant only the capabilities independently approved by the user.
  • Expose sanitized configuration values instead of the complete openclaw.json file.
  • Execute installation in an isolated staging workspace and review a generated change set before applying it.
  • Require separate explicit approval for authentication changes, executable installation, and every modification to core files such as IDENTITY.md.
  • Back up sensitive files and use atomic writes with automatic rollback.
  • Prevent bundle code from writing outside approved paths through filesystem sandboxing and canonical-path enforcement.
  • Redact secrets from process environments, logs, stdout, result files, and workspace files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.