OpenClaw Governance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:05 AM UTC
• Version: 1.1.0

Overview

This skill is mostly coherent for OpenClaw governance work, but it auto-installs and relies on executable third-party code from a mutable Git tag while enabling high-impact governance changes.

Review the upstream openclaw-governance source before installing, prefer a full commit SHA or hashed/registry release where possible, and run it with only the repository and GitHub permissions needed for governance work. Be careful sharing discovery JSON because repository remote URLs can expose private infrastructure or unusual embedded credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Third-Party Dependency Installed from a Mutable Git Tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–23
Additional Location: SKILL.md, lines 277–291
Vulnerability Type: Supply-chain risk caused by mutable dependency pinning
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: uv
    package: "openclaw-governance @ git+https://github.com/pawlsclick/openclaw-governance@v0.5.5"
    bins: [openclaw-gov]

The same dependency source is prescribed for manual installation:

bash

pipx install "openclaw-governance @ git+https://github.com/pawlsclick/openclaw-governance@v0.5.5"

bash

pip install "openclaw-governance @ git+https://github.com/pawlsclick/openclaw-governance@v0.5.5"

Technical Analysis

The Skill automatically installs, or directs operators to install, executable Python package code directly from a third-party Git repository. Although the dependency specifies version tag v0.5.5, a Git tag is not necessarily immutable. The installation instructions do not pin a reviewed commit SHA, verify the resolved commit, or provide an artifact integrity hash.

Consequently, the code executed by a later installation can differ from the code originally reviewed if the tag is moved or the upstream repository or maintainer account is compromised. The package's build and installation logic may execute with the privileges of the user or agent performing installation. The resulting openclaw-gov executable is then trusted throughout the Skill and receives access to governance paths, repositories, and Git operations.

This is a supply-chain weakness; the reviewed project does not itself prove that the current upstream package is malicious.

Attack Path

1. An attacker compromises the upstream repository, release process, or maintainer credentials.
2. The attacker moves or recreates the v0.5.5 tag so that it references a malicious commit.
3. ClawHub auto-installation, pipx, or pip retrieves source from the altered tag.
4. Malicious package build or ...[truncated 1105 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git dependency to a reviewed, immutable full commit SHA rather than a version tag.
2. Record the expected upstream release tag and corresponding commit so operators can verify their relationship.
3. Prefer a trusted package registry release backed by immutable artifacts and lock the exact package version.
4. Require cryptographic artifact hashes where the installer supports hash verification.
5. Verify downloaded source or artifacts before installation, particularly in automatic installation paths.
6. Use a locked dependency manifest and review transitive dependencies.
7. Execute installation and governance tooling with the least privileges necessary and without unrelated credentials in the environment.
8. Consider vendoring and reviewing the required code when stronger supply-chain assurance is necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes a command that outputs remote_url values from discovered Git repositories, which can reveal internal hostnames, organization names, or embedded credentials in unusual setups. The file does not provide any warning or disclosure about this privacy-sensitive output before presenting the command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.