ClawHub
Back to skill

Security audit

Clawstore

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Clawstore package-manager guide, but users should review commands before installing, logging in, or publishing packages.

Install only after confirming the npm package source, prefer a reviewed or pinned CLI version, inspect package details before installing agents, and run validation plus tarball review before publishing anything to avoid exposing private files or secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

markdown
## Prerequisites

The CLI must be installed globally:

```bash
npm install -g clawstore

Verify with clawstore --version.

text

### Technical Analysis

The Skill instructs users or Agents to install the latest available version of the third-party `clawstore` npm package globally. The dependency is not pinned to a reviewed version, and the instructions do not require verification of package provenance, integrity, publisher identity, or package contents.

npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, a compromised package release could execute arbitrary commands during installation. Because the installation is global, it also places executable files in a shared command path and may require elevated privileges on some systems.

This finding does not establish that the current `clawstore` package is malicious. The vulnerability is the unsafe, mutable supply-chain trust model prescribed by the Skill.

### Attack Path

1. An attacker compromises the npm publisher account, package repository, release pipeline, or another component responsible for publishing `clawstore`.
2. The attacker publishes a malicious release under the legitimate package name.
3. A user or Agent follows the Skill and executes `npm install -g clawstore` without a version constraint.
4. npm resolves the command to the attacker-controlled latest release.
5. Malicious lifecycle scripts execute during installation, or the installed `clawstore` executable runs attacker-controlled behavior when subsequently invoked.
6. The payload operates with the privileges of the account running npm and can potentially modify user files, access credentials available to that account, or replace globally accessible toolin
...[truncated 708 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specific reviewed version rather than installing the mutable latest release, for example: npm install -g clawstore@X.Y.Z.
  • Verify the expected package publisher, npm provenance attestations, repository, and release integrity before installation.
  • Prefer a project-local dependency recorded in a lockfile instead of a global installation where operationally feasible.
  • Review the package tarball and lifecycle scripts before approving a new version.
  • Consider installing with lifecycle scripts disabled, such as --ignore-scripts, when the package can operate without them.
  • Execute package installation as an unprivileged user and avoid sudo or administrator-level npm installation.
  • Document an approved version-update process that includes security review, integrity verification, and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The install section tells the agent to run a command that modifies the local OpenClaw workspace, but it does not explicitly warn that this operation writes files and introduces third-party package content into the environment. In a skill that may be invoked automatically from a user request, that omission can lead to unintended local changes or installation of unreviewed agent code/content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The publish section instructs uploading an agent package to a remote registry without clearly warning that local package contents will be transmitted externally. This can cause accidental disclosure of sensitive files, embedded secrets, or private intellectual property if the package contents have not been carefully reviewed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The login flow mentions a browser-based GitHub OAuth process but omits a warning that authentication will open an external browser and share account/authorization data with a remote service. This is primarily a consent and privacy issue: users may be surprised by the external auth flow or by the scope of access being granted.

Content

No source excerpt is available for this finding.