ClawHub
Back to plugin

Security audit

OpenClaw Parallel Plugin

Security checks for vulnerabilities and agentic risk

Overview

The verdict is benign overall: the scanner reports a prompt-injection weakness in upstream search metadata, while the other assessed dimensions are mostly acceptable or have limited concerns.

The verdict is benign, but the scan identifies a prompt-injection weakness. Before installing, consider whether you trust the configured search providers and whether you are comfortable with upstream metadata potentially influencing the model. The scan did not demonstrate successful model compliance or a privileged action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

MCP06

Warning
Location
dist/.setup/parallel-search-normalize-BDJxllHh.mjs:45
Finding

Unwrapped Upstream Metadata Enables Indirect Prompt Injection in Search Results ## Remediation Suggestions 1. **Validate metadata against explicit schemas.** Restrict `usage` to documented fields with expected numeric types and sensible bounds. Reject unexpected strings, nested objects, and unknown fields. 2. **Remove unnecessary upstream text.** Omit `warnings` if it is not required for the agent’s task. Otherwise, accept only bounded strings and process each through `wrapWebContent`. 3. **Protect every upstream-controlled text field consistently.** Review identifiers, URLs, publication metadata, and remote error text rather than assuming the result-level `wrapped` flag covers all content. 4. **Retain accurate trust metadata.** Do not declare a payload fully wrapped while forwarding unwrapped upstream text. Continue marking provider-derived content as untrusted. 5. **Cache only validated, normalized results.** Invalidate existing cache entries when deploying the revised schema. 6. **Add regression tests for both providers.** Verify that instruction-bearing warning strings, nested usage objects, oversized arrays, and unexpected metadata are rejected, omitted, or wrapped before reaching the model.

Content
View full analysis

Vulnerability Details

File Location: dist/.setup/parallel-search-normalize-BDJxllHh.mjs, lines 45–58
Vulnerability Type: Indirect prompt injection through unvalidated upstream metadata
Risk Level: Medium

Vulnerable Code

The shared response normalizer marks external content as wrapped but copies upstream metadata without wrapping or element validation:

js
		externalContent: {
			untrusted: true,
			source: "web_search",
			provider: params.provider,
			wrapped: true
		},
		results
	};
	if (typeof response.search_id === "string") payload.searchId = response.search_id;
	if (typeof response.session_id === "string") payload.sessionId = response.session_id;
	if (Array.isArray(response.warnings) && response.warnings.length > 0) payload.warnings = response.warnings;
	if (Array.isArray(response.usage) && response.usage.length > 0) payload.usage = response.usage;
	const cachePayload = !request.sessionId && "sessionId" in payload ? { ...payload } : payload;
	if (!request.sessionId) delete cachePayload.sessionId;

The free provider forwards these metadata fields directly from the remote MCP payload in dist/.setup/parallel-free-web-search-provider.runtime-D1ws2w9J.mjs, lines 159–167:

js
	const results = (Array.isArray(payload.results) ? payload.results : []).slice(0, Math.max(params.maxResults, 1));
	return {
		search_id: typeof payload.search_id === "string" ? payload.search_id : void 0,
		session_id: sessionId,
		results,
		warnings: payload.warnings,
		usage: payload.usage
	};

Technical Analysis

The normalizer protects search titles and excerpts with wrapWebContent, but applies only an array check to response.warnings and response.usage. These arrays can therefore contain arbitrary strings or nested objects that are copied unchanged into model-visible tool results.

This creates an inconsistent external-content boundary: the payload declares wrapped: true, although some upstream-controlled content is not wrapped. The ...[truncated 2062 chars]

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Endor dependency reachability

Checked Nov 10, 2026 · 5:50 PM UTC

No reachable vulnerabilities reported

Endor dependency scan completed.