ClawHub
Back to skill

Security audit

GUI Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill openly enables desktop control, but it relies on an unauthenticated local control API and unpinned third-party installation steps for a high-impact desktop server.

Install only if you intentionally want OpenClaw and any process able to reach the local server to control your desktop. Prefer a pinned, reviewed server version in an isolated environment, bind explicitly to 127.0.0.1, avoid background operation and sudo group changes unless necessary, and stop the server when finished.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:24
Finding

Unpinned Installation of a High-Privilege Third-Party Package

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish a requirements or lock file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Verify the package artifact against a hash distributed through an independent trusted channel. 4. Review and pin all transitive dependencies rather than only the top-level package. 5. Install the server in a dedicated virtual environment or isolated desktop environment. 6. Document the expected publisher, package index, version, and artifact hash. Do not describe `pip show` as an integrity check. 7. Periodically review pinned versions for known vulnerabilities before updating them. ]]>

T08 · Insecure Dependencies

Error
Location
SKILL.md:35
Finding

Mutable Source Checkout and Unpinned Source Dependencies

Content
View full analysis
Remediation
View remediation
``` 2. Verify the selected commit or release using a trusted signature or independently published checksum. 3. Supply a dependency lockfile with exact versions and cryptographic hashes. 4. Install dependencies using hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 5. Review installation hooks, build configuration, server entry points, and all dependency changes before approving a new commit. 6. Run the server in an isolated user account, container, virtual machine, or disposable desktop session with access only to required resources. 7. Document a controlled update process so users do not silently move to unreviewed upstream code. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:118
Finding

Desktop-Control API Requests Lack Authentication

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
This skill:
- ✅ Controls YOUR desktop when the server is running
- ✅ Runs with YOUR user privileges (no admin/sudo needed)
- ✅ Only accessible from localhost by default

## Security Best Practices

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

bash
# Simple health check
curl http://localhost:8000/status
# Should return: {"status": "ok"}

# Take a screenshot (safe test)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

The troubleshooting guidance instructs the user to run a sudo command that changes group membership, which requires elevated privileges and expands the account's ability to generate input events. In a desktop automation context, this increases the blast radius of misuse and normalizes privilege escalation in setup instructions.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

Permission Denied (Linux):

bash
# You may need to add your user to the input group for keyboard/mouse control
sudo usermod -a -G input $USER
# Log out and back in for changes to take effect

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

Capture the current screen:

bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

Click at specific x,y coordinates:

bash
# Click at center of 1280x720 screen
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "left_click", "params": {"x": 640, "y": 360}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

Get Screen Size

bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "get_screen_size"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example utterances are broad imperative phrases like taking screenshots, opening apps, typing text, and clicking the screen. In a skill that exposes direct desktop-control primitives, such generic invocation language increases the chance of accidental or insufficiently confirmed execution during ordinary conversation, which can trigger unintended UI actions and data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
1% confidence
Finding

No natural-language strings in the file appear to require a specific language or locale. Because SQP-3 is limited here to language/locale policy violations, this file does not contain a genuine violation.

Content

No source excerpt is available for this finding.