ClawHub
Back to skill

Security audit

Taskfit Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a small discovery skill that clearly points users to a TaskFit plugin and discloses that the plugin rewrites requests using local task-pattern data.

Before installing, review the linked TaskFit plugin because enabling it allows request rewriting before agent planning and uses patterns derived from local task history. Use the documented off/status controls if you do not want that behavior active, and prefer a reviewed or pinned release when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–27
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- GitHub repository: `https://github.com/Sheygoodbai/taskfit`
- Plugin install: `openclaw plugins install clawhub:@sheygoodbai/openclaw-taskfit`
- Enable plugin: `openclaw plugins enable taskfit`

Technical Analysis

The documented installation command identifies the third-party plugin by package name but does not pin an audited version or immutable content digest. It also provides no checksum or signature-verification procedure. Consequently, the code installed when a user runs this command may differ from the code that was reviewed.

The potential supply-chain impact is elevated by the documented plugin behavior. Lines 35–38 state that the plugin uses hooks to rewrite the current request before agent planning while processing patterns derived from local task history. A compromised plugin release could therefore execute within the plugin environment and interfere with requests or access data available to those hooks.

This finding establishes unsafe dependency guidance, not that the referenced plugin is currently malicious or compromised.

Attack Path

  1. An attacker compromises the package publisher, distribution registry, repository, or release process.
  2. The attacker publishes a modified release under the same mutable package identifier.
  3. A user follows the unpinned installation command in SKILL.md.
  4. OpenClaw resolves and installs the modified package because no immutable version, digest, or verified artifact is specified.
  5. The user enables the plugin, activating its pre-planning hooks.
  6. Malicious plugin code can then operate within the permissions and data access granted by the OpenClaw plugin runtime.

Impact Assessment

Successful exploitation could allow attacker-controlled plugin code ...[truncated 341 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to a specific audited version and, where supported, an immutable artifact digest.
  • Publish the expected cryptographic checksum and require verification before installation.
  • Use signed releases and document signature verification against a trusted publisher key.
  • Replace the mutable installation example with a command that resolves only the reviewed artifact.
  • Document the plugin's required filesystem, network, history, and request-hook permissions.
  • Apply least privilege and sandboxing to prevent plugin access beyond the functionality described.
  • Establish an update-review process rather than automatically trusting newer releases under the same package identifier.
  • Link to reproducible build information or a reviewed source revision corresponding exactly to the distributed artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest description and title prominently use Chinese text ("会下指令") as the skill's presented name, but the file does not indicate that language selection is optional or that the skill is intended only for a Chinese-language audience. This can violate a language/locale policy when users are not given an explicit opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.