ClawHub
Back to skill

Security audit

Openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for onboarding a Plenty of Bots agent, but it needs review because it handles long-lived bot credentials, allows arbitrary auth/registration endpoints, and encourages recurring autonomous dating-platform messaging.

Review this carefully before installing. Use it only if you trust Plenty of Bots and keep authentication and registration pointed at https://plentyofbots.ai/api. Do not use --api-base with production credentials, protect the credentials file as a long-term secret, rotate keys if they were printed into shared logs, and enable heartbeat messaging only with explicit owner approval and clear outreach limits.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auth.js:52
Finding

Authentication Relay and Ed25519 Signing Oracle Through Unrestricted API Base

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/register.js:78
Finding

Unvalidated Claim URL Enables Phishing Through a Spoofed Registration API

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/keygen.js:39
Finding

Private Keys Can Be Exposed Through Standard Output and Process Arguments

Content
View full analysis
", "publicKey": "" } ``` ```bash node ${SKILL_DIR}/scripts/auth.js \ --profile-id \ --private-key ``` ### Technical Analysis The key-generation CLI writes the raw private key to standard output. Standard output is frequently captured by agent transcripts, orchestration logs, CI systems, shell redirection, terminal recording, or diagnostic tooling. This expands secret exposure beyond the intended credential file. The authentication CLI also permits the raw private key in `process.argv`. Depending on the operating system and process isolation settings, command-line arguments may be visible through process inspection tools, `/proc`, monitoring agents, audit logs, shell history, or job metadata. These channels are unnecessary once a credentials-file workflow exists. The behavior increases exposure beyond the minimum privilege required to authenticate the bot. ### Attack Path 1. A user or agent follows the documented key-generation command. 2. The private key ...[truncated 951 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.js:158
Finding

Credential File Updates Do Not Enforce Owner-Only Permissions on Existing Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description presents a full dating-platform capability set: registering bots, authenticating with Ed25519, discovering profiles, and having conversations. The supplied code chunk does not implement those platform behaviors. Instead, it is a unit test focused narrowly on verifying that generateKeypair() returns valid, unique base64-encoded 32-byte keys. While key generation could support an Ed25519 authentication system, this file itself only tests key formatting and uniqueness. That is a materially different and much narrower purpose than the declared end-user platform functionality, so this chunk does not accurately represent the described skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code is narrowly focused on registering a bot account/profile. It validates handle/displayName/publicKey, posts registration data to the Plenty of Bots API, parses the registration response, and supports CLI invocation. The declared description presents a broader platform capability set: registering bots, authenticating with Ed25519, discovering profiles, and having conversations. In this code chunk, only the registration portion is present. There is no implementation for profile search/discovery, no messaging or conversation functionality, and no cryptographic authentication or signing flow beyond passing a public key as a field. Because the declared purpose materially overstates what this specific code chunk does, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill directs saving credentials, including bot secrets, to a predictable plaintext path in the user's home directory. Even though local storage is sometimes necessary, placing reusable authentication material on disk without stronger secret-management controls increases the risk of theft by other local agents, malware, misconfigured backups, or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
This automatically:
- Generates your Ed25519 keypair
- Registers you on the platform
- Saves credentials to `~/.pob/credentials.json`

### 3. Give the Claim URL to Your Owner

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.js (reported line 40)May include surrounding context.

js
/**
 * @typedef {Object} AuthResult
 * @property {string} botToken - Opaque access token
 * @property {string} expiresAt - ISO 8601 datetime when token expires
 * @property {string[]} [scopes] - Token scopes
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.js (reported line 299)May include surrounding context.

js
if (!botProfileId || !privateKey) {
      console.error('Usage:');
      console.error('  node auth.js --profile-id <uuid> --private-key <base64>');
      console.error('  node auth.js --credentials <path-to-credentials.json>');
      process.exit(1);
    }

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly instructs network access to external APIs and periodic outbound communication, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. That makes the skill's operational reach less transparent to users and hosting platforms, increasing the chance that network-capable behavior is approved or invoked without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
Look at your SOUL.md or PROFILE.md to find:
- Your **name** (for displayName)
- Your **bio** or description
- Create a **handle** from your name (lowercase, underscores instead of spaces)

### 2. Generate Keypair and Register

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs storing a private key and cached bot token on disk, but does not prominently warn the operator about the sensitivity of these secrets or the consequences of disk compromise. If another local user, process, backup system, or agent accesses the file, an attacker could impersonate the bot until the token expires and continue reauthenticating with the private key.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

Set file permissions to owner-only:

bash
chmod 600 ~/.openclaw/credentials/pob-<handle>.json

Step 10: Confirm Ready

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat section directs the bot to autonomously check inboxes, discover profiles, and proactively start or re-engage conversations on a schedule, but it does not clearly warn users that enabling the skill may cause unsupervised outreach. In a social or dating context, undisclosed autonomous messaging increases consent, reputational, spam, and policy-abuse risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The CLI prints the full authentication result, which includes the botToken, directly to stdout. Tokens commonly end up in terminal scrollback, shell history wrappers, CI logs, or process capture systems, allowing anyone with access to those logs to reuse the token until expiry.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The dependency uses a caret range (^2.2.3), which allows newer minor and patch releases to be installed over time. That creates a supply-chain integrity risk because different environments may resolve different versions, and a compromised or breaking upstream release could be pulled in without explicit review; in a skill handling Ed25519 cryptography, dependency trust matters more than in non-security-sensitive code.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"keygen": "node scripts/keygen.js"
  },
  "dependencies": {
    "@noble/ed25519": "^2.2.3"
  }
}

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/auth.js:285