ClawHub
Back to skill

Security audit

Lobster Companion Real

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a private companion-coordination tool, but it asks users to handle very sensitive relationship data while relying on unreviewed install scripts and mutable dependencies.

Review this skill before installing, especially if you would use location, health, emergency, or shared-password/document features. Only install from a trusted source, pin and verify dependencies, inspect any install.sh scripts before running them, avoid running installs with more privilege than needed, and confirm how data can be revoked and deleted before sharing sensitive information with another person.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:31
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: package.json, lines 31–34
Vulnerability Type: Dependency versions are mutable and no lockfile or integrity controls were supplied
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "@clawhub/secure-p2p-messenger": "^1.0.0",
  "@clawhub/lobster-friends-protocol": "^1.0.0"
}

Technical Analysis

Both third-party dependencies use caret version ranges. The ^1.0.0 constraint permits package managers to resolve later compatible releases rather than requiring the exact version reviewed by the project author.

The audited artifact contains no package lockfile, vendored dependency source, or independent integrity hashes. Consequently, an installation performed at a later date may obtain dependency code different from the code originally tested. The effective behavior of these dependencies—including package lifecycle scripts and runtime operations—cannot be verified from the supplied project.

This does not prove that either named dependency is currently malicious. The confirmed weakness is the lack of reproducible, integrity-controlled dependency resolution, which creates an exploitable supply-chain trust boundary.

Attack Path

  1. An attacker compromises a dependency publisher account, registry infrastructure, or another component of the dependency publication process.
  2. The attacker publishes a malicious version that remains compatible with the declared ^1.0.0 range.
  3. A user installs this Skill without a trusted lockfile.
  4. The package manager resolves and downloads the attacker-controlled compatible release.
  5. Malicious lifecycle code may execute during installation, or malicious dependency code may execute when the Skill invokes the dependency.
  6. The payload operates with the permissions of the account performing installation or running the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code executi ...[truncated 501 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace mutable ranges with exact, reviewed versions:
    json
    "dependencies": {
  "@clawhub/secure-p2p-messenger": "1.0.0",
  "@clawhub/lobster-friends-protocol": "1.0.0"
}
  2. Generate and commit the package manager lockfile, including registry-resolved URLs and integrity hashes.
  3. Use deterministic installation commands such as npm ci in deployment and installation workflows.
  4. Review the complete dependency source and all lifecycle scripts before approving each version.
  5. Configure trusted registry scopes for the @clawhub namespace and apply registry provenance or signature verification where available.
  6. Disable dependency lifecycle scripts during installation when they are unnecessary, for example with npm ci --ignore-scripts.
  7. Run installation and execution as an unprivileged account in a restricted environment with minimal filesystem, credential, and network access.
  8. Add automated dependency auditing and require explicit review before updating the lockfile.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly promotes sharing highly sensitive data such as real-time location, health information, and emergency signals, but the documentation does not present prominent risk warnings, consent boundaries, retention details, or abuse considerations. In a companion-tracking context, missing warnings can facilitate coercive surveillance, privacy harm, or unsafe assumptions about emergency features, making the omission security-relevant rather than merely editorial.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

场景3：任务协作

bash
# 创建共享任务列表
lobster-companion.sh tasks create "周末计划"

# 添加任务
lobster-companion.sh tasks add "周末计划" "买菜" --assign both

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The installation and initialization steps instruct users to install packages, run scripts, initialize databases, and create sensitive companion data stores without warning that these actions modify system state and may persist intimate personal data locally. For a skill centered on partner coordination and emergency workflows, this omission increases the risk of users creating sensitive records without understanding storage, backup, or local access implications.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

1. 安装依赖

bash
# 安装必需工具
sudo apt-get install sqlite3 jq openssl curl

# 安装基础技能
cd ~/.openclaw/workspace/skills/secure-p2p-messenger

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents all descriptions, examples, and instructions in Chinese and does not mention that the skill is region-specific or provide an opt-in language selection. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description string uses Chinese exclusively, which can impose a language choice on users without opt-in. Under the policy, locale or language constraints should either offer user choice or be clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using a caret range for a dependency allows future minor/patch releases to be installed without explicit review, which creates a supply-chain risk if an upstream package is compromised or publishes a breaking/malicious update. In a skill that handles encrypted P2P messaging and relationship coordination, trust in dependency integrity matters more because compromised libraries could affect confidentiality, synchronization, or contact data.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"README.md"
  ],
  "dependencies": {
    "@clawhub/secure-p2p-messenger": "^1.0.0",
    "@clawhub/lobster-friends-protocol": "^1.0.0"
  },
  "openclaw": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using a caret version for this protocol dependency permits automatic adoption of later releases that have not been explicitly vetted, increasing exposure to supply-chain compromise. Because this skill is described as a P2P encrypted companion coordination system, a compromised protocol library could impact message handling, metadata privacy, or peer trust assumptions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
],
  "dependencies": {
    "@clawhub/secure-p2p-messenger": "^1.0.0",
    "@clawhub/lobster-friends-protocol": "^1.0.0"
  },
  "openclaw": {
    "skill": true,