Claw Monitor

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:54 PM UTC
• Version: 0.1.3

Overview

The skill is a coherent OpenClaw monitoring guide with disclosed local inspection commands, though users should treat installation and session nudging as active actions.

Install `clawmonitor` only from a package source you trust, preferably in an isolated environment. Be aware that reports and status commands read local OpenClaw session state, and only use `nudge` when you intend to send a progress request into a running session.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-56
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

The skill recommends installing or upgrading clawmonitor and pip directly from the configured Python package repository without pinning versions, verifying hashes, or referencing a reviewed lock file.

Vulnerable Code Snippet

markdown

Install:

```bash
pip install -U clawmonitor

Alternative installs:

• pipx:

  bash

  pipx install clawmonitor
  

• Virtualenv:

  bash

  python3 -m venv .venv
  . .venv/bin/activate
  pip install -U pip
  pip install clawmonitor
  

text

### Technical Analysis

These commands resolve and install the latest package versions available from the user's configured Python package index. No exact version, cryptographic hash, trusted index requirement, or dependency lock file constrains the code that will be installed.

Consequently, the effective implementation may change after this skill has been reviewed. A compromised upstream release, package repository, mirror, dependency, or local package-index configuration could cause malicious code to be installed. Python package installation can invoke build-system components for source distributions, and the installed `clawmonitor` executable will subsequently run with the invoking user's permissions.

Updating `pip` through the same unpinned mechanism further expands the supply-chain exposure by replacing the package installer itself.

### Attack Path

1. An attacker compromises the `clawmonitor` package, one of its transitive dependencies, a configured package mirror, or another relevant supply-chain component.
2. The attacker publishes or serves a malicious version that satisfies the unconstrained installation request.
3. A user or agent follows the skill instructions and runs `pip install -U clawmonitor`, `pipx install clawmonitor`, or 
...[truncated 1138 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawmonitor to an explicitly reviewed version, for example:

   bash

   python3 -m pip install 'clawmonitor==X.Y.Z'
   

2. Maintain a reviewed requirements or lock file that pins all transitive dependencies.
3. Record and verify cryptographic hashes using a command such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Download and review packages in a controlled build process, then distribute them through an authenticated internal repository.
5. Explicitly specify an approved package index and prevent fallback to untrusted or user-controlled extra indexes.
6. Avoid automatically upgrading pip during skill execution. Manage installer upgrades separately through a controlled maintenance process.
7. Prefer an isolated virtual environment or pipx environment, but retain version and hash verification because isolation alone does not prevent supply-chain compromise.
8. If runtime installation is unavoidable, require explicit user approval before installing packages and clearly disclose that third-party code will execute with the user's permissions.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This monitoring skill instructs the agent to perform package installation and initialization steps that modify the host, including pip install and clawmonitor init, which writes configuration under the user's home directory. For an inspection-oriented skill, these side effects expand the trust boundary, can alter system state unexpectedly, and may introduce supply-chain risk if the package is fetched at runtime.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is framed as an inspection/monitoring tool, but it includes clawmonitor nudge, which actively sends a progress request into a session. That changes runtime behavior rather than merely observing it, and could interfere with workloads, trigger unexpected agent actions, or violate assumptions that the skill is safe for passive diagnostics.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.