Security audit

Claw Quest Connect

Security checks for vulnerabilities and agentic risk

Overview

The skill is clear about its purpose, but it handles reusable gateway credentials and operator-level device approval in ways that deserve careful review.

Review this skill before installing. It may place your gateway token or password into WhatsApp or chat history, and it may automatically approve a device with write-capable operator access. Prefer a flow with short-lived pairing codes, explicit destination confirmation, and manual review of the exact device request before approval.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:34
Finding: Automatic Disclosure of Shared Gateway Credentials Through WhatsApp or Chat
Content: View full analysis
` - `Gateway token: ` or `Gateway password: ` - `Use Claw Quest Android -> Manual Setup` Do not add extra formatting that makes mobile copy/paste harder. If WhatsApp sending fails or is unavailable: - say so plainly - provide the same three lines in chat instead ``` ### Technical Analysis The skill instructs the agent to retrieve a shared gateway token or pass ...[truncated 2292 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:89
Finding: Spoofable Device Attributes Can Trigger Automatic Operator-Level Approval
Content: View full analysis
``` Then immediately confirm with: ```powershell openclaw devices list --json ``` Tell the user whether approval succeeded and whether the paired device now shows: - role `operator` - scopes `operator.read` and `operator.write` Stop after one approval. Do not auto-approve unrelated requests. ``` ### Technical Analysis The workflow automatically approves the first pending request whose metadata resembles the expected Android client. The matching fields—such as `displayName`, `platform`, `clientId`, `clientMode`, requested role, and requested scopes—are descriptive client attributes rather than proof that the request originated from the user's intended phone. The instruction to match the request “as closely as possible” also creates ambiguous authorization behavior. It does not define which fields are mandatory, how mismatches are handled, or whether additional unexpected fields disqualify a request. An attacker who can reach the pairing endpoint and submit a pending request during the two-minute polling window can attempt to reproduce the documented values. If the malicious re ...[truncated 2324 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to retrieve the active gateway authentication secret and disclose it to the user for manual setup. Even if intended for legitimate pairing, exposing a live gateway token or password in plain language materially increases the risk of credential leakage, replay, interception, or misuse beyond the intended mobile device.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section mandates sending sensitive gateway credentials through WhatsApp, an external messaging channel, and falling back to chat if unavailable. Transmitting reusable authentication material over side channels expands exposure to message compromise, misdelivery, account takeover on the messaging platform, chat retention, and accidental forwarding, making the gateway easier to access by unauthorized parties.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The metadata and description advertise optional automatic approval of the next matching Android pairing request without a fresh human confirmation at decision time. Autonomous approval of a security-sensitive enrollment step weakens access control and can be abused if an attacker can craft or race a matching request that satisfies the specified attributes.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: clawquest-connect description: Use when the user wants to connect Claw Quest Android to this OpenClaw gateway with the manual URL+token flow, send those details over WhatsApp, and optionally auto-approve the next matching Android pairing request once. user-invocable: true metadata: {"openclaw":{"os":["win32","linux","darwin"],"requires":{"bins":["openclaw"]}}} ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill operationalizes auto-approval by instructing the agent to watch for pending requests and approve the first one that appears to match Claw Quest Android. Because the matching relies on mutable metadata fields such as display name and platform plus expected scopes/role, an attacker may be able to spoof these values and obtain operator-level access if their request is approved.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
- scopes `operator.read` and `operator.write` Stop after one approval. Do not auto-approve unrelated requests. ## What to tell the user

Static analysis

No suspicious patterns detected.