Security audit

Openclaw Link

Security checks for vulnerabilities and agentic risk

Overview

ClawLink appears purpose-built for agent collaboration, but it exposes remote tasking and shared files with weak trust boundaries that users should review carefully before installing.

Install only if you intend to run a trusted agent relay. Keep it on localhost where possible; if using a LAN or tunnel, require a strong token, place it behind HTTPS/WSS and additional access controls, and treat all incoming tasks, broadcasts, and shared files as untrusted until you approve them. Avoid uploading sensitive files and avoid writing downloaded shared files over important local paths.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:121
Finding: Untrusted relay tasks can redirect agent behavior without user approval
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/server.py:42
Finding: Shared relay authentication permits agent impersonation, queue theft, and unrestricted file access
Content: View full analysis
"}, status=401 ) return await handler(request) ``` ```python async def handle_register(request): data = await request.json() agent_id = data.get("agent_id", str(uuid.uuid4())[:8]) name = data.get("name", f"agent-{agent_id[:4]}") capabilities = data.get("capabilities", []) machine = data.get("machine", request.remote or "unknown") description = data.get("description", "") agent = registry.register(agent_id, name, capabilities, machine, description) ``` ```python async def handle_delegate(request): data = await request.json() from_agent = data.get("from_agent") to_agent = data.get("to_agent") task = data.get("task") context = data.get("context", {}) priority = data.get("priority", "normal") if not all([from_agent, to_agent, task]): return web.json_response( {"error": "from_agent, to_agent, and task are required"}, status=400 ) message = { "type": "task_delegation", "message_id": str(uuid.u ...[truncated 3936 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: README.md:32
Finding: Documented quick start exposes the relay on all interfaces without authentication
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/client.py:133
Finding: Sensitive relay credentials and collaboration data are transmitted over plaintext HTTP
Content: View full analysis
dict: h = {"Content-Type": "application/json"} if self.token: h["Authorization"] = f"Bearer {self.token}" return h def _post(self, endpoint: str, data: dict) -> dict: resp = requests.post( f"{self.relay_url}/{endpoint}", json=data, headers=self._headers(), timeout=10 ) resp.raise_for_status() return resp.json() def _get(self, endpoint: str) -> dict: resp = requests.get( f"{self.relay_url}/{endpoint}", headers=self._headers(), timeout=10 ) resp.raise_for_status() return resp.json() ``` ```python result = self._post("register", { "agent_id": agent_id, "name": name, "capabilities": capabilities or [], "machine": socket.gethostname(), "description": description }) ``` ```python def delegate(self, to_agent: str, task: str, context: dict = None, priority: str = "normal") -> dict: return self._post("delegate", { "from_agent": self.agent_id, "to_agent": to_agent, "task": task, "context": context or {}, "priority": priority }) def broadcast(self, content: str, topic: str = "general", tags: list = None) -> dict: return self._post("broadcast", { "from_agent": self.agent_id, "content": content, "topic": topic, "tags": tags or [] }) def respond(self, to_agent: str, message_id: str, result: str, status: str = "completed") -> dict: return self._post("respond", { "from_agent": self.agent_id, "to_agent": to_agent, "message_id": message_id, "result": result, "status": status }) def file_put(self, file_key: str, content: ...[truncated 2164 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.sh:24
Finding: Setup script installs unpinned third-party packages into the user environment
Content: View full analysis
/dev/null || echo " (mDNS skipped — manual --relay URL required for LAN, HTTP still works)" ``` ### Technical Analysis The setup script installs `aiohttp`, `requests`, and `zeroconf` without pinned versions, hashes, a lockfile, or an isolated environment. Package resolution therefore depends on mutable package indexes and whatever versions and transitive dependencies are current when the command runs. Python packages may execute installation or build code under the invoking user's account. A compromised upstream release, package-index compromise, dependency confusion condition, or malicious transitive dependency could execute code during installation. Installing into the user site-packages can also affect unrelated Python programs and allows preexisting package state to influence the Skill. No evidence was found that the named packages are intentionally malicious. The finding concerns the unsafe dependency acquisition and installation process. ### Attack Path 1. The user runs `scripts/setup.sh`. 2. `pip` resolves the latest acceptable releases and transitive dependencies from its configured package index. 3. An upstream package, transitive dependency, or configured index serves a compromised artifact. 4. Package build or installation code executes with the user's privileges. 5 ...[truncated 832 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README promotes cross-machine agent discovery, task delegation, knowledge sharing, and collaborative file editing, including over the internet, but provides no warning about authentication, authorization, privacy, or remote write risks. In an agent skill context, this can normalize connecting autonomous agents to an untrusted mesh where prompts, data, and file operations may be exposed or manipulated by other participants.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The quick start instructs users to bind the relay to 0.0.0.0 and suggests exposing it through ngrok or Cloudflare Tunnel, yet gives no access-control or hardening guidance. That combination materially increases the chance of unauthorized agents connecting, reading broadcasts, delegating malicious tasks, or modifying shared files, especially because this skill is designed for autonomous agent-to-agent coordination.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes capabilities that involve network communication, file sharing/editing, and use of environment-based secrets, but it declares no explicit tool scope or permission boundaries. In a skill whose purpose is cross-instance agent coordination, that omission is dangerous because it can enable unintended network access, file reads/writes, and token handling without clear least-privilege constraints or user-facing guardrails.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is extremely broad and activates on many generic phrases related to collaboration, multiple machines, or asking another agent to help. Because this skill enables cross-instance communication and collaborative file operations, over-triggering can cause the agent to invoke networked workflows unexpectedly, increasing the chance of data leakage, unintended delegation, or remote file manipulation in contexts where the user did not explicitly request ClawLink.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/client.py (reported line 149)May include surrounding context.
python
return h def _post(self, endpoint: str, data: dict) -> dict: resp = requests.post( f"{self.relay_url}/{endpoint}", json=data, headers=self._headers(),

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-put CLI reads an arbitrary local file and uploads its full contents to the configured relay server without any explicit confirmation, warning, or visibility prompt at the point of transmission. In this skill’s context—cross-machine agent coordination and file sharing—this increases the risk of accidental exfiltration of sensitive local data, especially when relay discovery can be automatic and the destination may not be carefully verified by the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file-get CLI writes server-provided content directly to a user-specified local output path using write mode, which can silently overwrite an existing file with untrusted remote data. In an agent-mesh workflow, this is dangerous because a compromised or misconfigured relay, or another untrusted participant, could cause destructive overwrites or plant misleading content in local files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.