OpenClaw Expansion Pack

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:46 PM UTC
• Version: 1.0.3

Overview

This skill is mostly documentation, but it tells users to run an unaudited setup script from a mutable external GitHub repository.

Review this before installing. Prefer installing only the individual components you need, pin Git repositories or ClawHub packages to reviewed versions, and inspect any setup script before running it. Do not run the full-pack setup path until the script is published, documented, and tied to an immutable release or commit.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:92
• Finding: Execution of an Unpinned Remotely Retrieved Setup Script## Vulnerability Details **File Location**: `SKILL.md`, lines 92-96 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash cd /home/node/.openclaw/workspace git clone https://github.com/pfaria32/openclaw-expansion-pack.git projects/openclaw-expansion-pack # Run setup script (coming soon) bash projects/openclaw-expansion-pack/setup.sh ``` ### Technical Analysis The documented installation process clones the current default branch of an external GitHub repository and then executes its `setup.sh` script. No immutable commit, signed release, checksum, or other integrity constraint is specified. Consequently, the effective code executed by this procedure can change after the Skill has been reviewed. The repository is also described as “coming soon,” and the setup script is not included in the audited artifact. Its behavior and security properties therefore cannot be verified from this project. This creates a time-of-check/time-of-use supply-chain risk: an upstream maintainer, a compromised maintainer account, or another party capable of modifying the repository could place arbitrary shell commands in the setup script after this artifact has passed review. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another publishing credential. 2. The attacker adds malicious commands to `setup.sh` or modifies another file invoked by that script. 3. A user follows the documented installation procedure without selecting an immutable revision. 4. `git clone` retrieves the attacker-controlled default branch. 5. The user runs `bash projects/openclaw-expansion-pack/setup.sh`. 6. The malicious commands execute with the permissions and environment of the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation. The attacker could access files and ...[truncated 439 chars]
• Remediation: ## Remediation Suggestions 1. Publish the setup script and all files it invokes so they can be reviewed before installation is recommended. 2. Reference an immutable, audited commit hash or signed release instead of the repository's mutable default branch. 3. Publish a cryptographic checksum for the approved source archive or script and require verification before execution. 4. Use signed Git commits or release artifacts and document how users must validate the trusted signing identity. 5. Separate retrieval from execution and instruct users to inspect the script before running it. 6. Run installation with the least-privileged dedicated account and restrict filesystem, network, and credential access. 7. Do not describe the full installation option as ready until the referenced repository and setup script exist and have undergone security review.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82
• Finding: Unpinned Git and Registry Dependencies## Vulnerability Details **File Locations**: `SKILL.md`, lines 82-85; `README.md`, lines 23-31 **Vulnerability Type**: Insecure dependencies **Risk Level**: Medium **Vulnerable Code in `SKILL.md`**: ```bash git clone https://github.com/pfaria32/OpenClaw-Shield-Security.git projects/OpenClaw-Shield git clone https://github.com/pfaria32/open-claw-token-economy.git projects/token-economy git clone https://github.com/pfaria32/openclaw-recursive-self-improvement.git projects/recursive-self-improvement git clone https://github.com/pfaria32/openclaw-capability-awareness.git projects/capability-awareness-system ``` **Vulnerable Code in `README.md`**: ```bash clawhub install openclaw-expansion-pack ``` ```bash clawhub install openclaw-shield clawhub install token-economy clawhub install recursive-self-improvement clawhub install capability-awareness ``` ### Technical Analysis The Git installation commands retrieve mutable default branches, while the ClawHub installation commands provide package names without exact versions. None of the commands specify immutable commit hashes, locked versions, expected checksums, trusted signing identities, or signature-verification steps. A review of the current upstream content therefore does not guarantee that later users will receive the same content. If an upstream account or registry package is compromised, or if a mutable package release is replaced, subsequent installations could retrieve altered components without any integrity failure being reported. This finding concerns unsafe dependency acquisition. The audited project itself contains only documentation, and no malicious code was identified in its two local files. The actual behavior of the referenced external components could not be verified because those components are not included in the artifact. ### Attack Path 1. An attacker compromises an upstream repository, publisher account, registry account, or associa ...[truncated 1085 chars]
• Remediation: ## Remediation Suggestions 1. Pin every Git dependency to a reviewed full commit hash rather than cloning only the default branch. 2. Pin every ClawHub package to an exact immutable version using the registry's supported version syntax. 3. Maintain a lock file or installation manifest recording package names, versions, commit hashes, checksums, and trusted publishers. 4. Verify cryptographic signatures or published checksums before activating downloaded components. 5. Document the expected repository owner and registry publisher identity so users can detect namespace or publisher changes. 6. Review all dependency updates before changing pinned revisions, and use automated scanning for unexpected ownership, script, permission, or network-behavior changes. 7. Prefer reproducible release archives over mutable branches and retain a verified copy of each approved dependency.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to execute a setup script directly from a freshly cloned repository without describing what the script changes, what privileges it requires, or how to verify its safety. In an agent or automation context, this is risky because a setup script can modify files, install dependencies, alter configuration, or execute arbitrary commands, and the surrounding 'production-ready' framing may encourage trust and reduce scrutiny.