ClawHub
Back to skill

Security audit

Openclaw Plugin

Security checks for vulnerabilities and agentic risk

Overview

This is an instructional OpenClaw plugin-development skill with powerful but disclosed examples; the main risks are developer-safety guidance gaps, not hidden behavior.

Before installing or following the README commands, verify the official ClawHub CLI package identity and prefer pinned versions. Treat generated OpenClaw plugins as trusted code: review any config-writing, messaging, provider, web-search, media, subagent, or credential-handling code before running it, and avoid placing real API keys or bot tokens in shared config files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:34
Finding

Unpinned and Inconsistently Named CLI Packages May Execute Untrusted Registry Code

Content
View full analysis

Vulnerability Details

File Location: README.md:34-36 and README.md:53-55
Vulnerability Type: Supply-chain exposure through mutable and inconsistent npm package resolution
Risk Level: Medium

Vulnerable Code

markdown
- **`clawhub` CLI:** Install the official CLI tool:
  ```bash
  npm install -g @openclaw/clawhub-cli
text

```markdown
Users can then install it using:
```bash
npx clawhub install openclaw-plugin-creator-skill
text

### Technical Analysis

The instructions execute packages fetched from npm without pinning an exact version or verifying package integrity. The documented global installation uses the scoped package `@openclaw/clawhub-cli`, but the subsequent `npx` command resolves the different, unscoped package name `clawhub`.

Unless those package identities are independently verified as equivalent, this discrepancy can cause `npx` to download and immediately execute code from an unintended package. npm packages may execute CLI entry points and, depending on npm configuration and package contents, lifecycle scripts. Registry ownership compromise, malicious version publication, dependency compromise, or confusion between the scoped and unscoped names could therefore lead to arbitrary local code execution.

This finding concerns the installation instructions. The audited repository itself contains documentation only and does not include an executable payload.

### Attack Path

1. An attacker publishes or compromises the unscoped `clawhub` npm package, one of its dependencies, or a mutable version selected by the registry.
2. A user follows `README.md:55` and runs:
   ```bash
   npx clawhub install openclaw-plugin-creator-skill
  1. npx resolves and downloads the unscoped package rather than necessarily invoking the previously documented @openclaw/clawhub-cli package.
  2. npm executes the downloaded package's CLI code and potentially applicable installation behavior with the invoking user's privileges.
  3. Malici ...[truncated 904 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use one verified package identity consistently. If the official package is @openclaw/clawhub-cli, invoke its installed binary rather than resolving the unrelated unscoped package through npx.
  2. Pin an audited exact version:
    bash
    npm install -g --ignore-scripts @openclaw/clawhub-cli@<verified-version>
  3. Publish and document integrity information or a signed release-verification process.
  4. Avoid npx commands that implicitly download mutable packages. If temporary execution is necessary, specify the exact verified package and version explicitly.
  5. Use --ignore-scripts where the package supports operation without lifecycle scripts.
  6. Document how users can verify the npm publisher, package scope, version, and provenance before installation.
  7. Reconcile the installation command with the later invocation. For example:
    bash
    npm install -g --ignore-scripts @openclaw/clawhub-cli@<verified-version>
clawhub install openclaw-plugin-creator-skill
  8. Test the corrected commands in a clean environment to ensure that they resolve only the intended scoped package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill declares that it is triggered whenever the user asks for OpenClaw development tasks and advertises broad self-extension capabilities such as writing tools, channels, and providers. In an agentic environment, such wide activation scope can cause the skill to engage on loosely related requests and generate or modify code, integrations, or publishing steps without clear boundaries, increasing the chance of unsafe changes or abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says to use this skill whenever the user wants to create, extend, debug, or publish any OpenClaw plugin, skill, or hook, which is an overly broad trigger that can cause this powerful instructional content to activate for many general development requests. Because the skill teaches creation of trusted in-process plugins with tool, hook, route, and runtime capabilities, over-invocation increases the chance that risky plugin patterns are suggested in contexts where they were not specifically requested or security-reviewed.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
60% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
# OpenClaw Plugin Development — Expert Reference

## 🛡️ Security, Privacy & Trust
This skill is purely instructional and does not execute remote code, access external endpoints (other than documentation), or modify system files without explicit user direction. All generated code should be reviewed before execution.
- **Data Privacy:** This skill does not collect or transmit user data.
- **External Calls:** No hidden background network requests.
- **Trust Statement:** This skill follows OpenClaw's security best practices for plugin development.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

Step 5 — Runtime helpers (api.runtime)

typescript
// Read/write config
const cfg = api.runtime.config.loadConfig();
await api.runtime.config.writeConfigFile({ ...cfg, talk: { enabled: true } });

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly shows an API key being stored directly in openclaw.yml (plugins.entries.acme-ai.config.apiKey: "sk-...") without any warning about secret handling. In documentation for plugin authors, this pattern can normalize insecure secret storage, leading to accidental commits of credentials to source control, leakage via backups, logs, or shared config files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation shows how to persist configuration changes via writeConfigFile(...) but does not explicitly warn that this modifies durable user/system state and can enable features or alter plugin settings beyond the current session. In a plugin-creator skill, that omission can lead developers to ship plugins that silently change host configuration, creating integrity and persistence risks if used without clear user consent and scope restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The web search example omits any notice that search queries may be transmitted to external services, which can expose prompts, proprietary terms, or user-sensitive data. Because this skill teaches plugin authors how to build runtime integrations, lack of a privacy warning increases the chance that developers forward user input to remote search providers without disclosure or sanitization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The subagent example forwards documentContent into another agent session without warning that data is being copied into a separate processing context, which may have different logging, retention, or access boundaries. In an agent/plugin development skill, this can normalize cross-session data forwarding without developers assessing confidentiality or lifecycle implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The media-understanding examples process image URLs, base64 images, and audio buffers without warning that these inputs may contain highly sensitive personal or regulated data and may be handled by remote services. In the context of a plugin-construction skill, this missing warning can encourage developers to submit user media to analysis endpoints without consent, minimization, or compliance review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provider-plugin.md (reported line 117)May include surrounding context.

md
resolveProviderApiKey: () => ({ apiKey: "test-key" }),
    } as any);
    expect(result?.provider?.models).toHaveLength(2);
    expect(result?.provider?.baseUrl).toBe("https://api.acme-ai.com/v1");
  });

  it("returns null catalog when no key", async () => {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provider-plugin.md (reported line 151)May include surrounding context.

md
resolveProviderApiKey: () => ({ apiKey: "test-key" }),
    } as any);
    expect(result?.provider?.models).toHaveLength(2);
    expect(result?.provider?.baseUrl).toBe("https://api.acme-ai.com/v1");
  });

  it("returns null catalog when no key", async () => {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/provider-plugin.md (reported line 272)May include surrounding context.

md
resolveProviderApiKey: () => ({ apiKey: "test-key" }),
    } as any);
    expect(result?.provider?.models).toHaveLength(2);
    expect(result?.provider?.baseUrl).toBe("https://api.acme-ai.com/v1");
  });

  it("returns null catalog when no key", async () => {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/testing.md (reported line 98)May include surrounding context.

md
resolveProviderApiKey: () => ({ apiKey: "test-key" }),
    } as any);
    expect(result?.provider?.models).toHaveLength(2);
    expect(result?.provider?.baseUrl).toBe("https://api.acme-ai.com/v1");
  });

  it("returns null catalog when no key", async () => {

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file embeds example TypeScript that performs a network messaging action via client.sendMessage(...), but the surrounding documentation does not warn that invoking the action transmits message content to an external platform. Under SQP-2 for markdown/code, user-affecting network operations should have some disclosure when the description presents the behavior without warning.

Content

No source excerpt is available for this finding.