Stringclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:28 AM UTC
• Version: 0.0.9

Overview

The skill is openly for making real phone calls, but it needs review because it starts a background bridge with reusable tokens and uses an unpinned executable dependency without enough confirmation or containment guidance.

Install only if you are comfortable with a skill that can place real outbound calls, may consume Stringclaw minutes, configures your local OpenClaw gateway, and runs a background bridge with API and gateway credentials. Before use, require explicit confirmation for each call, pin or verify the bridge package, avoid running it with elevated privileges, use scoped/rotatable credentials, and stop the bridge when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Executable Receives Sensitive Credentials

Content

View full analysis

stringclaw-bridge serve > /tmp/stringclaw-bridge.log 2>&1 & ``` The Skill metadata also requires `STRINGCLAW_API_KEY`, which will ordinarily be available in the process environment: ```yaml requires: env: ["STRINGCLAW_API_KEY"] bins: ["stringclaw-bridge"] ``` ### Technical Analysis The npm package `@stringclaw/bridge` is specified without an exact version or integrity hash. Consequently, installation may resolve to a future package release whose contents differ from those reviewed during this audit. This dependency is especially sensitive because its executable is launched with `OPENCLAW_GATEWAY_TOKEN` explicitly present in its environment and may also inherit `STRINGCLAW_API_KEY`. The Skill enables the gateway chat-completions endpoint before launching the executable. A compromised package release, registry account, transitive dependency, or package-resolution path could therefore execute arbitrary code with the invoking user's privileges and access these credentials. The audit found no evidence that the currently referenced package is malicious. The vulnerability is the absence of dependency pinning and integrity verification around a security-sensitive executable. ### Attack Path 1. An attacker compromises the package publisher, npm account, registry path, or an unpinned transitive dependency. 2. The attacker publishes a modified version that satisfies the unconstrained package reference. 3. A user installs the Skill dependency and receives the modified package. 4. The user follow ...[truncated 1057 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:53

Finding

Predictable Shared Temporary Log Path Permits Symbolic-Link Attacks

Content

View full analysis

stringclaw-bridge serve > /tmp/stringclaw-bridge.log 2>&1 & sleep 8 cat /tmp/stringclaw-bridge.log ``` ### Technical Analysis The bridge output is redirected to the fixed path `/tmp/stringclaw-bridge.log`. On typical multi-user Unix systems, `/tmp` is shared and permits users to create entries. Standard shell output redirection follows symbolic links and opens the destination with truncation enabled. An attacker able to create `/tmp/stringclaw-bridge.log` before the victim runs this command can make it a symbolic link to another file writable by the victim. The shell may then truncate and overwrite that target using bridge log output. Reusing a predictable path can also expose diagnostic data to other local users if the resulting permissions are affected by a permissive umask or preexisting file ownership and mode. The environment assignment itself does not normally place `OPENCLAW_GATEWAY_TOKEN` in the redirected output. Credential disclosure through the log would require the bridge to print sensitive information. The confirmed flaw is the unsafe handling of the predictable temporary path. ### Attack Path 1. A local attacker predicts the documented path `/tmp/stringclaw-bridge.log`. 2. Before the victim starts the bridge, the attacker creates that path as a symbolic link to a file writable by the victim. 3. The victim executes the documented bridge startup command. 4. Shell redirection follows the symbolic link and opens the linked target with truncation. 5. The target file is truncated and receives bridge output. 6. Depending on the selected target and the victim's privileges, this causes data loss, configuration corruption, or denial of service. 7. Separately, if the created log is readable by other users and contains sensitive diagnosti ...[truncated 706 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The invocation phrases are broad everyday language such as 'call me' or 'phone me', which can easily appear in normal conversation and accidentally trigger a real-world side effect. Because this skill initiates outbound phone calls, unintended activation could cause unauthorized calls, billing impact, and privacy issues.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

2. Create the voice agent (if it doesn't exist)

bash

openclaw agents add voice --model gemini-3.1-flash-lite-preview --non-interactive

If that errors because it already exists, skip this step.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description and instructions do not prominently warn that it will place a real outbound phone call with potential billing, telephony, and privacy consequences. In a skill whose primary action affects the outside world, lack of clear user-facing disclosure materially increases the chance of surprise or uninformed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to read and reuse the gateway auth token, then inject it into environment variables and HTTP Authorization headers. That exposes a reusable credential to the skill execution path for a task that should not require manual token retrieval, increasing the risk of credential disclosure, misuse, or reuse beyond the intended voice-call flow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Call connects but AI never responds: Test the gateway directly:

bash

curl -X POST http://127.0.0.1:18789/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"model":"voice","messages":[{"role":"user","content":"hi"}],"stream":true}'