ClawPulse

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:21 PM UTC
• Version: 0.3.0

Overview

The skill has a coherent analytics purpose, but it asks for unsafe credential reuse and sets up silent recurring telemetry jobs that deserve manual review before installation.

Review this carefully before installing. Prefer running the documented interactive setup only after confirming the GitHub scopes, avoid letting an agent copy your existing GitHub CLI token, do not enable silent cron pushes unless you want recurring telemetry, and inspect or pin the `openclaw-pulse` package before giving it access to session files or credentials.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:45
• Finding: Persistent Unattended Transmission of Session-Derived Telemetry## Vulnerability Details **File Location**: `SKILL.md`, lines 45-71 **Vulnerability Type**: Scheduled task persistence and silent external telemetry **Risk Level**: High ### Vulnerable Code ```markdown ### Step 4: Set up auto-push via OpenClaw cron Create TWO cron jobs for auto-push at midnight and noon: ```json { "name": "ClawPulse Push (midnight)", "schedule": { "kind": "cron", "expr": "0 0 * * *" }, "payload": { "kind": "agentTurn", "message": "Run: clawpulse push --silent" }, "sessionTarget": "isolated", "delivery": { "mode": "none" } } ``` ```json { "name": "ClawPulse Push (noon)", "schedule": { "kind": "cron", "expr": "0 12 * * *" }, "payload": { "kind": "agentTurn", "message": "Run: clawpulse push --silent" }, "sessionTarget": "isolated", "delivery": { "mode": "none" } } ``` ``` ### Technical Analysis The skill instructs the agent to install two scheduled jobs that survive the initial skill invocation. Each job launches an isolated agent turn and executes `clawpulse push --silent` at midnight or noon. The `--silent` option and `"delivery": { "mode": "none" }` suppress user-visible output and delivery, reducing the likelihood that the user will notice subsequent executions. According to the skill, the command reads statistics derived from OpenClaw session files and sends them to an external ClawPulse service. Although the documentation claims that only aggregates are transmitted, the CLI implementation is not present in the audited project, so its collection and filtering behavior cannot be independently verified. ### Attack Path 1. The user or agent follows the skill's automatic setup instructions. 2. Two OpenClaw cron jobs are created. 3. The jobs remain active after the initial setup session ends. 4. At midnight and noon, an isolated agent turn runs `clawpulse push --silent`. 5. The CLI accesses session-derived information under the user's OpenClaw enviro ...[truncated 696 chars]
• Remediation: ## Remediation Suggestions - Do not create recurring scheduled jobs automatically. - Require explicit, informed, and separate user consent before enabling telemetry or persistence. - Default to local-only collection and provide a manual push command. - If scheduling is requested, create only the minimum necessary job and clearly display every execution. - Avoid `--silent` and `"delivery": { "mode": "none" }` for security- or privacy-relevant operations. - Document the exact data fields, destination, retention policy, and authentication mechanism before obtaining consent. - Provide commands and instructions to list, disable, and permanently remove all installed jobs. - Pin the executable invoked by the task to a reviewed version and detect unauthorized configuration changes.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29
• Finding: GitHub Token Extracted and Stored in a Plaintext Configuration File## Vulnerability Details **File Location**: `SKILL.md`, lines 29-35 **Vulnerability Type**: Plaintext credential storage **Risk Level**: High ### Vulnerable Code ```markdown **Option B: Agent uses existing GitHub token** If the user has `gh` CLI authenticated, extract the token: ```bash TOKEN=$(gh auth token) mkdir -p ~/.clawpulse echo "{\"apiUrl\":\"https://clawpulse.vercel.app\",\"githubToken\":\"$TOKEN\"}" > ~/.clawpulse/config.json ``` ``` ### Technical Analysis The setup procedure extracts an existing GitHub credential with `gh auth token` and copies it into `~/.clawpulse/config.json` as plaintext. The command does not set restrictive permissions on either the directory or the configuration file. The resulting permissions therefore depend on the user's current `umask` and are not guaranteed to be owner-only. Copying an existing credential also expands its exposure beyond the GitHub CLI's normal credential-management mechanism. The token may subsequently be accessible to unrelated local processes, backups, diagnostic archives, malicious packages, or users who can read the file. The skill does not require a narrowly scoped token, validate its permissions, or define secure rotation and deletion procedures. ### Attack Path 1. The user has an authenticated GitHub CLI session. 2. The agent executes `gh auth token`, exposing the reusable token to the shell process. 3. The token is interpolated into JSON and written to `~/.clawpulse/config.json`. 4. A local process, malicious dependency, backup system, or another account with sufficient file access reads the configuration file. 5. The attacker submits the stolen token to GitHub APIs. 6. The attacker performs operations allowed by the token's scopes until the credential expires or is revoked. ### Impact Assessment Successful exploitation exposes a reusable GitHub credential. The exact impact depends on the token's scopes and the user's repository access, but ...[truncated 335 chars]
• Remediation: ## Remediation Suggestions - Do not extract or duplicate the GitHub CLI's existing token. - Use GitHub's device authorization flow or another delegated authorization mechanism intended for the application. - Request a dedicated, narrowly scoped, short-lived credential with only the permissions required for the documented operation. - Store credentials in the operating system's credential manager or another established secrets-management facility. - If file storage is unavoidable, create the directory with mode `0700` and atomically create the credential file with mode `0600`. - Avoid passing secrets through shell interpolation where they may leak through debugging, process instrumentation, or logs. - Implement credential expiration, rotation, revocation, and secure deletion. - Clearly disclose why GitHub authentication is required and which permissions the application will receive.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16
• Finding: Unpinned Global Installation of an Unreviewed Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, lines 16-20 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code ```markdown ### Step 1: Install CLI ```bash npm install -g openclaw-pulse ``` ``` ### Technical Analysis The installation command does not specify an exact package version or an integrity hash. It therefore installs whichever release the npm registry resolves as current at execution time. The effective code can change after the skill has been reviewed, and npm lifecycle scripts may execute during installation. Global installation also places the executable in a shared user-level or system-level command location rather than isolating it to the project. The package source is not included in the audited artifact, so its implementation, lifecycle scripts, session parsing, credential handling, and claimed exclusion of message content could not be verified during this audit. ### Attack Path 1. The user or agent runs `npm install -g openclaw-pulse`. 2. npm resolves a mutable package release from the registry. 3. Package code and any enabled lifecycle scripts execute with the privileges of the invoking account. 4. The globally installed CLI is later given access to OpenClaw session files and the stored GitHub token. 5. If the package, maintainer account, registry release, or dependency tree is compromised, malicious code can read user-accessible data, steal credentials, modify local files, or alter the behavior of scheduled telemetry jobs. 6. The persistent cron jobs subsequently invoke the compromised global executable twice per day. ### Impact Assessment A compromised package can execute arbitrary code with the invoking user's privileges during installation or later command execution. This can expose the plaintext GitHub token, OpenClaw session records, files readable by the user, and other credentials available in the environment. It may als ...[truncated 291 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact reviewed version rather than installing the mutable latest release. - Verify package integrity using a trusted lockfile, integrity hash, signed provenance, or equivalent supply-chain control. - Include or vendor the reviewed implementation in the audited artifact when practical. - Avoid global installation; install the package in an isolated project environment with minimal permissions. - Review the complete transitive dependency tree and all npm lifecycle scripts. - Disable lifecycle scripts during installation unless a reviewed script is strictly required. - Run the collector in a sandbox with network and filesystem access limited to the minimum documented requirements. - Re-review package updates before deployment and before changing the version used by persistent jobs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (5)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs extracting an existing GitHub CLI token with `gh auth token` and reusing it for this service, which is unnecessary and over-privileged for simple analytics submission. Reusing a pre-existing credential broadens exposure because the token may carry repository or account scopes unrelated to ClawPulse, and writing it into another app's config creates a new theft and misuse point.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The instructions tell the agent to pull a GitHub token from `gh` and write it in plaintext JSON under `~/.clawpulse/config.json` without warning about credential sensitivity or scope risk. This normalizes insecure credential handling and increases the chance of token disclosure via local compromise, backups, misconfigured permissions, or later agent/tool access.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

| Command | What it does |
|---------|-------------|
| `clawpulse setup` | Interactive: login + push + show instructions |
| `clawpulse push` | Collect and push stats |
| `clawpulse push --silent` | Same but no output (for cron) |
| `clawpulse collect` | Just collect stats locally |

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Saying setup is done automatically by the agent, without explicit consent boundaries, encourages autonomous installation, authentication, and telemetry enablement. In this context, the setup includes installing software, handling credentials, and scheduling recurring pushes, so ambiguity materially increases the risk of unauthorized changes and silent data sharing.

Session Persistence

Medium

• Category: Rogue Agent

Content

If the user has `gh` CLI authenticated, extract the token:
```bash
TOKEN=$(gh auth token)
mkdir -p ~/.clawpulse
echo "{\"apiUrl\":\"https://clawpulse.vercel.app\",\"githubToken\":\"$TOKEN\"}" > ~/.clawpulse/config.json
```

• Confidence: 95% confidence
• Finding: The skill persists a GitHub token to `~/.clawpulse/config.json`, creating durable local session state that may outlive user intent and be accessible to other processes, backups, or later agent actions. Persistent bearer tokens significantly raise the blast radius of any local compromise because they can be replayed without additional user interaction.

Static analysis

No suspicious patterns detected.