ClawHub
Back to skill

Security audit

OpenClaw Contract Review

Security checks for vulnerabilities and agentic risk

Overview

The contract-review workflow is mostly clear and purpose-aligned, but the published bundle metadata has provenance and integrity problems that should be reviewed before installation.

Install only after the publisher republishes or explains the bundle metadata: the runtime instructions are not malicious, but the manifest should not expose developer paths and its checksums should match the distributed files. Also confirm you trust the required contract_review plugin and its handling of contract files, authentication, and Feishu-style progress notifications.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
bundle-manifest.json:11
Finding

Developer Workstation Identity and Absolute Path Disclosure

Content
View full analysis

Vulnerability Details

File Location: bundle-manifest.json, lines 11, 19, 27, 35, 43, and 51
Vulnerability Type: Build metadata and developer identity disclosure
Risk Level: Low

The public bundle manifest contains six absolute source paths from the developer's workstation:

json
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/SKILL.md",
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/README.md",
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/references/intent-routing.md",
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/references/auth-gate.md",
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/references/execution-rules.md",
"sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/references/examples.md",

Technical Analysis

The generated release metadata retains absolute paths from the build environment. These paths disclose:

  • The developer or workstation account name: renzhiping
  • The operating-system directory convention: /Users/...
  • The local workspace and repository layout
  • The internal source locations of the published files

Absolute build paths are unnecessary for Skill installation, integrity verification, or runtime operation. Public artifacts should contain only bundle-relative paths or sanitized source identifiers. Although the disclosure does not directly expose credentials or enable code execution, it provides environment-specific reconnaissance that can improve the credibility and precision of subsequent attacks.

Attack Path

  1. An attacker downloads or otherwise obtains the published Skill bundle.
  2. The attacker opens bundle-manifest.json without needing authentication or code execution.
  3. The attacker extracts the workstation username, operating-system layout, repo ...[truncated 1148 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every sourcePath field containing an absolute local path from public manifests.
  2. Replace absolute paths with bundle-relative values such as SKILL.md or references/auth-gate.md.
  3. Modify the manifest generator so build-machine paths are never serialized into release artifacts.
  4. Add a release sanitization step that rejects:
    • Unix home-directory paths such as /Users/ and /home/
    • Windows user-profile paths such as C:\Users\
    • Internal hostnames and network paths
    • Developer usernames, secrets, tokens, and private repository locations
  5. Add automated CI checks that scan the final packaged artifact rather than only the source directory.
  6. Regenerate and republish the bundle after sanitization, then verify that checksums and provenance metadata reference only public, non-sensitive identifiers.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
- `SKILL.md` 只保留高层编排、门控顺序、公开边界与关键禁止事项

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is a required locale for this skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description and all operating instructions are written entirely in Chinese, and the trigger examples and required responses are framed only in Chinese. There is no indication that the user can choose another language or that this is a region-specific skill with a documented justification, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill declares very broad natural-language triggers such as '帮我看看合同' and '继续上次的审核', which can match ordinary conversation and cause the agent to enter a contract-review workflow unexpectedly. In a user-invokable skill that dispatches directly to a review tool, overbroad matching increases the chance of unintended tool invocation, accidental document handling, or workflow confusion if intent disambiguation is imperfect.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
87% confidence
Finding

The manifest exposes an absolute local filesystem path in the sourcePath field (/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/SKILL.md). This leaks developer username, directory structure, and repository layout, which can aid reconnaissance and environment fingerprinting if the bundle is published or shared externally.

Content

Scanner excerpt · bundle-manifest.json (reported line 11)May include surrounding context.

json
"relativePath": "SKILL.md",
      "kind": "main",
      "required": true,
      "sourcePath": "/Users/renzhiping/workspace/openclaw-plugin/skills/contract-review/SKILL.md",
      "checksum": "278d7785d9084b7a38e32bb1f1bbb6bc1525c36d1066add19ddbf30141d34934"
    },
    {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents all operational guidance in Chinese and does not indicate that users may choose another language or that the locale restriction is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing interaction rules and example responses entirely in Chinese, including statements like '唯一合法响应' that prescribe the required response format. Because the file does not offer language/locale opt-in or explain that the skill is intentionally region-specific, it may violate the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document is written entirely in Chinese and does not offer any language or locale choice for users or operators. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document is written as an instruction file in Chinese and states the routing rules directly in that language, effectively imposing a specific language/locale on the skill behavior. The file does not offer a user opt-in or alternative language choice, and no region-specific justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The natural-language note is written only in Chinese, which can impose a language/locale constraint without any visible opt-in or documented justification. The policy for this review flags language or locale requirements when the skill does not offer user choice or explain why the restriction is necessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.