Stringclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:28 AM UTC
• Version: 0.0.9

Overview

The skill is openly for making real phone calls, but it needs review because it starts a background bridge with reusable tokens and uses an unpinned executable dependency without enough confirmation or containment guidance.

Install only if you are comfortable with a skill that can place real outbound calls, may consume Stringclaw minutes, configures your local OpenClaw gateway, and runs a background bridge with API and gateway credentials. Before use, require explicit confirmation for each call, pin or verify the bridge package, avoid running it with elevated privileges, use scoped/rotatable credentials, and stop the bridge when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unpinned Third-Party Executable Receives Sensitive Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11-15; credential-bearing execution occurs at lines 53-55 **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@stringclaw/bridge" bins: ["stringclaw-bridge"] ``` The installed executable is subsequently started with access to credentials: ```bash OPENCLAW_GATEWAY_TOKEN=<token> stringclaw-bridge serve > /tmp/stringclaw-bridge.log 2>&1 & ``` The Skill metadata also requires `STRINGCLAW_API_KEY`, which will ordinarily be available in the process environment: ```yaml requires: env: ["STRINGCLAW_API_KEY"] bins: ["stringclaw-bridge"] ``` ### Technical Analysis The npm package `@stringclaw/bridge` is specified without an exact version or integrity hash. Consequently, installation may resolve to a future package release whose contents differ from those reviewed during this audit. This dependency is especially sensitive because its executable is launched with `OPENCLAW_GATEWAY_TOKEN` explicitly present in its environment and may also inherit `STRINGCLAW_API_KEY`. The Skill enables the gateway chat-completions endpoint before launching the executable. A compromised package release, registry account, transitive dependency, or package-resolution path could therefore execute arbitrary code with the invoking user's privileges and access these credentials. The audit found no evidence that the currently referenced package is malicious. The vulnerability is the absence of dependency pinning and integrity verification around a security-sensitive executable. ### Attack Path 1. An attacker compromises the package publisher, npm account, registry path, or an unpinned transitive dependency. 2. The attacker publishes a modified version that satisfies the unconstrained package reference. 3. A user installs the Skill dependency and receives the modified package. 4. The user follow ...[truncated 1057 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@stringclaw/bridge` to a reviewed, immutable exact version rather than relying on unconstrained resolution. 2. Use a lockfile and verify package integrity with a trusted cryptographic digest. 3. Pin and audit all transitive dependencies, and install only from an explicitly trusted registry. 4. Require package-signature or provenance verification where supported. 5. Run the bridge under a dedicated, unprivileged account or sandbox with minimal filesystem and network access. 6. Supply only the credentials required by the bridge instead of allowing it to inherit the complete parent environment. 7. Scope and rotate `STRINGCLAW_API_KEY` and the gateway token, and provide revocation procedures for suspected dependency compromise. 8. Document the reviewed package version in `SKILL.md` and establish a controlled process for dependency upgrades. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53
• Finding: Predictable Shared Temporary Log Path Permits Symbolic-Link Attacks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53-57 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```bash OPENCLAW_GATEWAY_TOKEN=<token> stringclaw-bridge serve > /tmp/stringclaw-bridge.log 2>&1 & sleep 8 cat /tmp/stringclaw-bridge.log ``` ### Technical Analysis The bridge output is redirected to the fixed path `/tmp/stringclaw-bridge.log`. On typical multi-user Unix systems, `/tmp` is shared and permits users to create entries. Standard shell output redirection follows symbolic links and opens the destination with truncation enabled. An attacker able to create `/tmp/stringclaw-bridge.log` before the victim runs this command can make it a symbolic link to another file writable by the victim. The shell may then truncate and overwrite that target using bridge log output. Reusing a predictable path can also expose diagnostic data to other local users if the resulting permissions are affected by a permissive umask or preexisting file ownership and mode. The environment assignment itself does not normally place `OPENCLAW_GATEWAY_TOKEN` in the redirected output. Credential disclosure through the log would require the bridge to print sensitive information. The confirmed flaw is the unsafe handling of the predictable temporary path. ### Attack Path 1. A local attacker predicts the documented path `/tmp/stringclaw-bridge.log`. 2. Before the victim starts the bridge, the attacker creates that path as a symbolic link to a file writable by the victim. 3. The victim executes the documented bridge startup command. 4. Shell redirection follows the symbolic link and opens the linked target with truncation. 5. The target file is truncated and receives bridge output. 6. Depending on the selected target and the victim's privileges, this causes data loss, configuration corruption, or denial of service. 7. Separately, if the created log is readable by other users and contains sensitive diagnosti ...[truncated 706 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private runtime directory owned by the invoking user with mode `0700`. 2. Generate the log path with `mktemp` rather than using a fixed filename. 3. Set a restrictive umask, such as `umask 077`, before creating the log. 4. Refuse symbolic links and preexisting files when opening the destination. Where practical, use an implementation that applies `O_CREAT | O_EXCL | O_NOFOLLOW`. 5. Do not run the bridge startup command with administrative privileges. 6. Remove temporary logs after use and apply log rotation and retention controls if persistent diagnostics are required. 7. Ensure the bridge never logs API keys, gateway tokens, authorization headers, or other sensitive values. 8. Prefer a per-user logging facility or service manager that securely creates and owns log files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The invocation phrases are broad everyday language such as 'call me' or 'phone me', which can easily appear in normal conversation and accidentally trigger a real-world side effect. Because this skill initiates outbound phone calls, unintended activation could cause unauthorized calls, billing impact, and privacy issues.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 2. Create the voice agent (if it doesn't exist)

```bash
openclaw agents add voice --model gemini-3.1-flash-lite-preview --non-interactive
```

If that errors because it already exists, skip this step.

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description and instructions do not prominently warn that it will place a real outbound phone call with potential billing, telephony, and privacy consequences. In a skill whose primary action affects the outside world, lack of clear user-facing disclosure materially increases the chance of surprise or uninformed consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to read and reuse the gateway auth token, then inject it into environment variables and HTTP Authorization headers. That exposes a reusable credential to the skill execution path for a task that should not require manual token retrieval, increasing the risk of credential disclosure, misuse, or reuse beyond the intended voice-call flow.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Call connects but AI never responds:**
Test the gateway directly:
```bash
curl -X POST http://127.0.0.1:18789/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"model":"voice","messages":[{"role":"user","content":"hi"}],"stream":true}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.