Security audit

jhjhghg

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent security-plugin installer purpose, but its setup script has high-impact risks around credential handling, machine fingerprinting, unpinned plugin installation, command execution, and deletion of configured paths.

Review this skill before installing. It may be legitimate for ClawSentry setup, but it changes OpenClaw plugin state, sends a stable machine fingerprint to vendor endpoints, stores login and credential-related data locally, installs an unpinned external plugin, and contains setup-code weaknesses that could expose credentials or execute unintended commands if the remote response or local config is compromised.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bundle.cjs:8
Finding: Shell Command Injection Through API-Controlled Plugin Credentials
Content: View full analysis
/tmp/clawsentry-command-injection) ``` could be interpreted and executed by the shell when the configuration command runs. TLS reduces the likelihood of casual network modification, but it does not address a compromised API service, compromised upstream infrastructure, or malicious server-side response. ### Attack Path 1. An attacker gains control of, or the ability to influence, the login identity API response. 2. The attacker places shell command-substitution syntax in `ApiKey`, `AppId`, or `Version`. 3. The polling process receives the response and ...[truncated 841 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bundle.cjs:4
Finding: Plaintext API Credentials Disclosed in Polling Logs
Content: View full analysis
typeof a=="object"?JSON.stringify(a):a).join(" "), r=`${o(new Date)} - INFO - ${i}\n`; n.write(r), c.apply(console,t) }; console.error=function(...t){ let i=t.map(a=>typeof a=="object"?JSON.stringify(a):a).join(" "), r=`${o(new Date)} - ERROR - ${i}\n`; n.write(r), s.apply(console,t) } } ``` The complete remote response is then logged: ```javascript async function ee(e,n){ let o=`${P}/OpenTOP/V1/Console/GetLoginTokenIdentity`, c={"X-Ai-Device-Fingerprint":n}, s={LoginToken:e}; console.log("[poll-login] Calling GetLoginTokenIdentity API..."); try { let {statusCode:t,data:i}=await N(o,c,s); return console.log(`[poll-login] Response status code: ${t}`), console.log(`[poll-login] Response content: ${JSON.stringify(i)}`), i } catch(t) { return t.message==="Request timeout" ? console.error("[poll-login] Request timeout! Unable to connect to server") : console.error(`[poll-login] Request exception: ${t.message}`), {} } } ``` The subsequent code confirms that this response can contain credentials: ```javascript function oe(e,n){ let o=e.ApiKey,c=e.AppId,s=e.Version; ``` ### Technical Analysis After authorization, the identity response can contain `ApiKey`, `AppId`, and related account information. The script serializes and logs the entire response without redaction. The log stream is created without an explicit restrictive file mode, so its effective permissions depend on the process umask and existing file ...[truncated 1188 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bundle.cjs:2
Finding: Stable Device Fingerprint Derived from Hostname and MAC Addresses Contrary to Privacy Disclosure
Content: View full analysis
{ let n=V(), o=`${P}/OpenTOP/V1/Console/CreateLoginToken`, c={"X-Ai-Device-Fingerprint":n}; ``` The project documentation states in `SKILL.md`, lines 36–38: ```markdown - The script generates a per-machine device identifier locally, then sends only its SHA-256 hash as `X-Ai-Device-Fingerprint` for device-binding of the login session. - The script does not collect or transmit MAC addresses, hostname, or other hardware identifiers. ``` It also documents a `.state/device_id` file, but the reviewed executable code does not create or use that file. ### Technical Analysis The executable enumerates external network interfaces, collects their MAC addresses, reads the system hostname, concatenates those values, and hashes the result. Although the raw values are not transmitted directly, the resulting digest is deterministic and stable while the underlying identifiers remain unchanged. Hashing does not remove the tracking characteristic of a stable identifier. It also does not support the documentation's statement that MAC addresses and hostname are not collected: they are explicitly read and processed in memory. The implementation therefore materially differs from the stated privacy design of a randomly generated local device identifier. ### Attack Path 1. Th ...[truncated 972 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/bundle.cjs:2
Finding: Unpinned Third-Party Plugin Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bundle.cjs:6
Finding: Arbitrary Recursive Directory Deletion Through Unvalidated Plugin Install Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description is written in Chinese and does not provide an English alternative or indicate that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint without user opt-in, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script collects a stable device fingerprint derived from hostname and MAC addresses, then stores it together with login state and token metadata in a local .state directory without explicit notice, consent, or protection controls. Even if intended for authentication flow, this creates privacy and local secret-handling risk because other local users, backups, or support tooling could access persistent identifiers and session-related data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script transmits a device fingerprint and login token to vendor-controlled remote endpoints as part of the login process, but there is no explicit user disclosure or consent in the code path before this occurs. In a security-plugin installer, hidden collection and transmission of persistent identifiers is especially sensitive because users may assume the tool improves privacy/security rather than exporting host identity data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.