ClawHub
Back to skill

Security audit

Signalgrid Activity

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it tells users to enable OpenClaw's unrestricted full tool profile for a narrow notification-sending task.

Review before installing. Use this only if you are comfortable sending notification content and Signalgrid credentials/channel metadata to Signalgrid. Avoid secrets or sensitive incident details in titles and bodies, use revocable scoped credentials if available, and prefer a constrained OpenClaw profile or isolated environment instead of enabling unrestricted full tools.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:125
Finding

Unnecessary Requirement for Unrestricted Tool Profile

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:125 and README.md:16
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: Medium

Relevant Code Snippets:

SKILL.md:125

markdown
-   And ensure your OpenClaw **Tool Profile** is set to `full`  ( Config -> Tools -> Tool Profile )

README.md:16

markdown
3. **Set Tool Profile**: You MUST set the tool profile to **full**. Without this, the skill cannot reach the Signalgrid API.

Technical Analysis

The skill explicitly instructs users to enable OpenClaw's full tool profile. However, the reviewed implementation only requires execution of Node.js, access to the SIGNALGRID_CLIENT_KEY and SIGNALGRID_CHANNEL environment variables, and outbound HTTPS connectivity to api.signalgrid.co:443.

No functionality in signalgrid-activity.js demonstrates a legitimate need for unrestricted shell, filesystem, or unrelated tool access. Requiring the broad profile therefore violates the principle of least privilege and expands the security boundary beyond the skill's stated notification-delivery purpose.

Although the current script does not directly exploit these additional permissions, enabling them increases the possible impact of prompt injection, another compromised skill, or a malicious future update.

Attack Path

  1. A user follows the installation documentation and enables the full tool profile.
  2. The agent receives access to tools beyond those needed to submit a Signalgrid notification.
  3. Attacker-controlled instructions reach the agent through prompt injection, a compromised skill, or a malicious package update.
  4. Those instructions invoke the unnecessarily exposed tools.
  5. Depending on the tools available under the host's full profile, the attacker may access local files, execute commands, inspect sensitive resources, or perform actions unrelated to Signalgrid notifications.

Impac

...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to enable the unrestricted full tool profile from both SKILL.md and README.md.
  2. Configure the narrowest available profile that permits only:
    • Execution of the bundled Node.js entry point.
    • Read access to SIGNALGRID_CLIENT_KEY and SIGNALGRID_CHANNEL.
    • Outbound TLS connections to api.signalgrid.co on port 443.
  3. Deny access to unrelated shell commands, filesystem locations, credentials, integrations, and administrative tools.
  4. If OpenClaw cannot express these restrictions, explicitly document the expanded privilege boundary and advise users to run the skill in an isolated, minimally privileged environment.
  5. Apply outbound network allowlisting so the process can contact only the documented Signalgrid endpoint.
  6. Run the OpenClaw process under a dedicated operating-system account without administrative privileges and with access only to files required by the skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Most of the code aligns with the declared purpose: it collects arguments, reads Signalgrid credentials from environment variables, builds a multipart form payload, and posts activity-related data to Signalgrid. That matches a tool for sending Live Activities or ongoing notifications. However, there is a material implementation mismatch because the script ends with console.log(JSON.stringify({ ok: true, sent_type: finalType, critical: isCritical })); even though isCritical is never defined anywhere. This means the code will throw a ReferenceError after sending the request, so the actual behavior is not a cleanly functioning notification sender as described. No evidence of unrelated data access, hidden exfiltration, or unrelated capabilities was found.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md
---
description: Send Live-Activities & Ongoing-Notifications to your iOS / Android phones using
  Signalgrid.
homepage: "https://web.signalgrid.co"
metadata:
  clawdbot:
    emoji: 📲
    primaryEnv: SIGNALGRID_CLIENT_KEY
    requires:
      bins:
      - node
      env:
      - SIGNALGRID_CLIENT_KEY
      - SIGNALGRID_CHANNEL
name: signalgrid-activity
---

# Signalgrid Live Activities

Send Live Activities & Ongoing Notifications to your phone through the Signalgrid API.

## When to use

Use this skill whenever the user asks to:  
   
  o    start an ongoing notification

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to store Signalgrid credentials and describes sending live activities/notifications to phones, but it does not clearly warn that request content will be transmitted to a third-party service off-device using those stored credentials. This can mislead users into sending sensitive operational details through the skill without understanding the privacy and data-flow implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

The skill requires persistent account credentials to be stored in OpenClaw configuration, creating a standing authentication context that can be reused by the skill in future sessions. While common for API integrations, this increases risk if the environment is shared, compromised, or if the skill can be invoked unexpectedly, because notifications could be sent without fresh user re-authentication.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

md
## Setup

1. **Create an Account**: 
Get your credentials at https://web.signalgrid.co

2. **Configure OpenClaw**:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The statement that the AI 'automatically uses this skill when you ask to start live activities' is overly broad and may trigger external network actions based on loosely matched prompts. In a tool profile with full network access, ambiguous auto-invocation increases the chance of unintended notification delivery and accidental disclosure of prompt content to the third-party API.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires environment variables and invokes Node-based code, but the manifest does not declare any explicit tool scope or allowed-tools restrictions. That weakens least-privilege controls and can let the skill run with broader capabilities than users or orchestrators expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages sending arbitrary notification titles and bodies to Signalgrid but does not clearly warn that this content leaves the local environment and is transmitted to a third-party service. In context, users may include sensitive operational details such as deployment status, backup names, incident text, or internal identifiers, creating an avoidable data-leak risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code reads a client key and channel from environment variables and sends them, along with title/body content, to an external HTTPS endpoint. There is no confirmation prompt, user-visible logging before transmission, or explanatory comment/docstring disclosing that user/system data is being posted off-host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The code pulls SIGNALGRID_CLIENT_KEY and SIGNALGRID_CHANNEL from process environment variables to authenticate outbound requests. While this may be a practical implementation detail, the manifest description only states that the skill sends live activities/notifications and does not indicate any credential-reading capability, making this a mild context-expansion beyond the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.