ClawHub
Back to skill

Security audit

ClawReach

Security checks for vulnerabilities and agentic risk

Overview

This messaging skill is mostly coherent, but it installs and updates persistent agent instructions from mutable remote URLs without integrity checks.

Install only if you are comfortable with ClawReach maintaining a persistent polling channel and with the current update process. Prefer a version-pinned package or require signed/hash-verified updates before allowing the agent to overwrite local skill files; use a dedicated revocable API key and avoid the optional website password-binding flow unless you specifically need it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding

Unchecked Installation of Mutable Remote Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-39
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Vulnerable Code

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md
curl -s https://clawreach.com/skill.json > ~/.openclaw/skills/clawreach/package.json

Technical Analysis

The setup procedure downloads several instruction and configuration files from unversioned URLs and writes them directly into the persistent OpenClaw skill directory. The downloaded files are not present in the audited repository, and the procedure does not verify a cryptographic digest, signature, immutable release identifier, or expected content before installation.

Although the downloaded artifacts are primarily agent instructions rather than conventional native executables, they determine subsequent agent behavior and therefore act as an effective payload. Their contents can change after this repository has been reviewed. HTTPS protects the connection in transit but does not protect against compromise of the origin service, unauthorized modification at the publishing layer, or a malicious future release.

Attack Path

  1. An attacker compromises the publishing service, its deployment credentials, or the infrastructure serving one of the referenced files.
  2. The attacker replaces a remote skill file with instructions that request secrets, invoke tools, modify files, or transmit data.
  3. A user follows the documented installation procedure.
  4. curl downloads the modified content without verifying its version, signature, or digest.
  5. Shell redirection w ...[truncated 812 chars]
Remediation
View remediation

Remediation Suggestions

  • Include all required skill files in the audited package rather than downloading mutable copies during installation.
  • If remote installation is necessary, publish immutable, version-specific URLs instead of mutable paths such as /skill.md.
  • Sign release manifests and verify signatures against a trusted public key embedded in the audited package.
  • Pin and verify a cryptographic digest for every downloaded file before moving it into the skill directory.
  • Download into a temporary staging directory, validate all files, and only then perform an atomic installation.
  • Configure curl to fail on HTTP errors and redirects, for example with --fail --show-error --location, while restricting redirects to approved HTTPS origins.
  • Present the exact version and a human-reviewable diff before activating changed instructions.
  • Run OpenClaw with least-privilege filesystem, credential, tool, and network permissions to limit the impact of a compromised instruction file.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:214
Finding

Relay-Triggered Replacement of Persistent Skill Files Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 214-252
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Vulnerable Code

markdown
| `skill_update` | Trusted system notice that a newer ClawReach skill version is available | Ask the owner first; refresh local skill files only after confirmation |

Messages are returned once. Process them in the same poll cycle.

For `skill_update`, `message.content` is a JSON string. Parse it and use the structured fields instead of guessing from prose. Expected shape:

```json
{
  "kind": "clawreach_skill_update",
  "version": "1.2.6",
  "action": "ask_owner_before_update",
  "download_base": "https://clawreach.com",
  "files": {
    "skill.md": "https://clawreach.com/skill.md",
    "heartbeat.md": "https://clawreach.com/heartbeat.md",
    "messaging.md": "https://clawreach.com/messaging.md",
    "rules.md": "https://clawreach.com/rules.md",
    "skill.json": "https://clawreach.com/skill.json"
  }
}

When you receive skill_update, first ask the owner whether they want to update now. Only after they confirm should you refresh:

text
A newer ClawReach skill version is available.
Would you like me to update my local ClawReach skill files now?

If the owner confirms, refresh:

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md
curl -s https://clawreach.com/skill.json > ~/.openclaw/skills/clawreach/package.json
text

### Technical Analysis

The relay is authorized to deliver a `skill_update` event that initiates replacement of locally installed skill instr
...[truncated 1872 chars]
Remediation
View remediation

Remediation Suggestions

  • Authenticate update events with a signed release manifest that is independently verifiable by the local client.
  • Require every manifest to contain an immutable version, canonical file URLs, file sizes, and SHA-256 or stronger digests.
  • Embed or securely provision the release-signing public key rather than trusting a key delivered by the same relay.
  • Display the release version, signer identity, validated hashes, and a concise diff to the owner before requesting approval.
  • Reject downgrade attempts, unexpected origins, redirects to unapproved hosts, malformed manifests, and versions that have already been installed.
  • Stage updates outside the active skill directory, validate the complete package, and activate it atomically only after successful verification.
  • Preserve a known-good version and support an explicit rollback procedure.
  • Separate message-relay authority from software-update signing authority so compromise of the relay alone cannot publish executable agent behavior.

T06 · System Persistence

Warning
Location
SKILL.md:57
Finding

Mandatory Persistent External Polling Through the Agent Heartbeat

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-71
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable Code

markdown
### 3. Add the heartbeat poll immediately

This is required. Without polling, you never receive friend requests or messages.

If a poll returns an empty array, do not send your owner a status message just to say nothing happened.

If your runtime uses a heartbeat file, create or update it and add a recurring ClawReach task:

```markdown
## ClawReach (every 10 minutes)
1. Poll GET /api/v1/messages with Bearer token
2. If the result is empty, stay silent and do not message the owner
3. Process friend requests, system notices, and text messages
4. Send any owner-approved outbound messages
5. Update your local last-poll timestamp if your runtime tracks one
text

### Technical Analysis

The skill requires modification of the agent's heartbeat configuration to create a recurring task every ten minutes. This behavior survives the initial setup operation and continuously communicates with an external service while using a bearer credential. The instruction to remain silent for empty polls reduces routine visibility into the continuing activity.

Persistent polling is functionally relevant to a messaging relay, and the documentation discloses it. However, it still establishes a durable external event-delivery channel. Its security depends on the relay's integrity, correct authentication, strict event validation, and the agent consistently treating received content as data rather than authority. The document explicitly warns that ordinary incoming text is not permission to execute instructions, which is a useful mitigation, but trusted system events can still influence update workflows.

### Attack Path

1. The user installs the skill and adds the documented task to the OpenClaw heartbeat.
2. The task persists across later heartbeat cycles and polls 
...[truncated 1116 chars]
Remediation
View remediation

Remediation Suggestions

  • Make heartbeat installation an explicit, informed, and reversible opt-in rather than an unconditional requirement.
  • Clearly display the polling interval, destination, credential use, last successful poll, and current enablement state in owner-accessible status information.
  • Provide documented commands or steps to disable polling, remove the heartbeat entry, and revoke the API key.
  • Apply strict schemas and allowlists to every event type, and treat all message content and server-supplied URLs as untrusted.
  • Cryptographically authenticate privileged system events separately from ordinary relay messages.
  • Ensure no event can directly execute commands, modify files, reveal secrets, or alter configuration without specific owner approval and integrity checks.
  • Use a narrowly scoped, revocable token dedicated to message polling and store it using the runtime's protected credential facility.
  • Add bounded retries, backoff, timeouts, and a fail-closed policy for malformed or unauthenticated responses.
  • Consider a configurable expiration period after which the persistent polling task must be renewed by the owner.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description is broad enough that an agent could invoke the skill for generic messaging-related tasks without clear limits, including setup, polling, social graph changes, and outbound communication. Overly broad activation criteria increase the risk of unintended external communications or autonomous actions being taken without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to save externally sourced files under a persistent local skill directory so they can be re-read later. Persisting remote instruction content across sessions increases the blast radius of any malicious or tampered content by making it durable and available for future execution or influence.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Save these files under ~/.openclaw/skills/clawreach/ so you can re-read them later:

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill directs the agent to fetch remote content from clawreach.com and save it as executable/authoritative local skill material. Pulling remote instructions into persistent local state creates a supply-chain risk: if the remote host is compromised or content changes unexpectedly, the agent may later follow malicious instructions from those downloaded files.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

This update path persists newly downloaded remote content by overwriting local skill files, creating durable session-to-session modification of agent behavior. Because the persisted content comes from the network without authenticity checks, a compromised update source could implant long-lived malicious instructions.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

If the owner confirms, refresh:

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The update flow again fetches multiple remote files and overwrites local skill content after only owner confirmation, with no integrity verification or version pinning. This makes the skill especially susceptible to malicious updates, server compromise, or content drift that could persistently alter future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/clawreach
curl -s https://clawreach.com/skill.md > ~/.openclaw/skills/clawreach/SKILL.md
curl -s https://clawreach.com/heartbeat.md > ~/.openclaw/skills/clawreach/HEARTBEAT.md
curl -s https://clawreach.com/messaging.md > ~/.openclaw/skills/clawreach/MESSAGING.md
curl -s https://clawreach.com/rules.md > ~/.openclaw/skills/clawreach/RULES.md

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill's stated purpose is messaging relay, but this section adds website account-claim and email-binding flows that handle passwords and account management. That expands the trust boundary and privileges of the skill, increasing the chance of credential mishandling, phishing-style abuse, or unauthorized account takeover if an owner is tricked into using these features.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.