ClawHub
Back to skill

Security audit

Gstack OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly prompt documentation, but it needs review because it gives stale script-execution install instructions and under-scopes production-impacting workflows.

Install through ClawHub rather than the manual git clone path, and do not run ./install.sh from the remote repository unless you inspect and pin the exact commit. Treat deployment, rollback, GitHub, browser-login, webhook, and telemetry examples as production-impacting guidance: use test accounts and staging by default, keep tokens and session data out of logs, and require explicit approval before any merge, deploy, rollback, or notification action.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:76
Finding

Execution of an Unpinned Remote Installation Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:76-78
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/openclaw/gstack-openclaw ~/.openclaw/skills/gstack
cd ~/.openclaw/skills/gstack && ./install.sh

Technical Analysis

The manual installation instructions clone the repository's mutable default branch and immediately execute an install.sh file from the downloaded content. They do not pin the repository to an immutable commit or signed release and do not require checksum or signature verification before execution.

Consequently, the content executed by users can differ from the artifact reviewed during this audit. Anyone who compromises the upstream repository, its maintainer account, or the relevant branch can replace install.sh with arbitrary commands that will execute under the installing user's account.

The audited artifact does not contain install.sh. The instruction therefore fails against the current artifact, but it may execute a script supplied by the remote repository. It also contradicts the documentation-only security statements in SKILL.md and SECURITY.md, which say that the installation script was removed and that the Skill does not execute scripts.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or the mutable default branch.
  2. The attacker adds or modifies install.sh to contain a malicious payload.
  3. A user follows the manual installation instructions in SKILL.md.
  4. git clone retrieves the attacker-controlled repository state without pinning or integrity verification.
  5. The shell changes into the cloned directory and runs ./install.sh.
  6. The payload executes with all filesystem, process, credential, and network permissions available to the installing user.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the u ...[truncated 728 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the obsolete ./install.sh command and make all installation documentation consistent with the claim that the project is documentation-only.
  2. Prefer installation through a trusted package mechanism that verifies immutable, reviewed releases.
  3. If cloning remains supported, pin the command to a reviewed commit or signed release tag rather than a mutable default branch.
  4. Publish and require verification of a cryptographic checksum or signature for release artifacts.
  5. Do not execute downloaded scripts automatically. If a script is genuinely necessary, require users to inspect it before running it and document every permission and side effect.
  6. Add an automated documentation test that rejects references to nonexistent or removed executable files.
  7. Correct SKILL.md, README.md, and SECURITY.md together so installation instructions and security claims cannot diverge.

T08 · Insecure Dependencies

Warning
Location
_skills/benchmark/SKILL.md:317
Finding

Unpinned Global Installation and Execution of Lighthouse CI

Content
View full analysis

Vulnerability Details

File Location: _skills/benchmark/SKILL.md:317-322
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
### Lighthouse CI
```bash
# Install
npm install -g @lhci/cli

# Run
lhci autorun
text

### Technical Analysis

The benchmark instructions install `@lhci/cli` globally without specifying a reviewed version or enforcing package integrity. npm therefore resolves the mutable version selected by the registry at installation time.

npm package installation can execute package lifecycle scripts. The subsequently invoked `lhci autorun` also executes code supplied by the installed package. If the package, a transitive dependency, a maintainer account, or the registry distribution channel is compromised, users following these instructions may execute code that was not present during the Skill audit.

The global installation scope is broader than necessary for project-specific performance benchmarking. It changes user-level tooling and makes the selected binary available outside the project in which the benchmark is performed.

### Attack Path

1. An attacker compromises `@lhci/cli`, one of its transitive dependencies, its publisher account, or its package distribution path.
2. The attacker publishes a malicious version that is selected by the unpinned npm command.
3. A user follows the benchmark setup instructions.
4. `npm install -g @lhci/cli` downloads the mutable package and may execute malicious lifecycle scripts.
5. The user runs `lhci autorun`, executing the installed package code.
6. Malicious code operates with the installing user's permissions and may affect environments beyond the benchmark project because the package was installed globally.

### Impact Assessment

Exploitation could permit arbitrary code execution with the npm user's privileges. Potential effects include:

- Reading or modifying files available to the user.
- Accessing source code and enviro
...[truncated 506 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @lhci/cli to a specifically reviewed version instead of resolving the latest available release.
  2. Add it as a project-local development dependency rather than installing it globally.
  3. Commit and enforce a lockfile with npm integrity metadata.
  4. Install dependencies with a deterministic command such as npm ci.
  5. Use a trusted internal registry mirror or dependency allowlist in sensitive CI environments.
  6. Review package provenance, maintainers, release signatures, and transitive dependencies before upgrades.
  7. Where compatible, disable lifecycle scripts during installation and explicitly enable only those proven necessary.
  8. Execute the tool in an isolated container or restricted CI runner with minimal filesystem access, no unnecessary credentials, and constrained network permissions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (54)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
- `SKILL.md` — 本文件（主技能描述）

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The metadata and opening description frame the package as a 'thinking collection', but the documented functionality includes concrete operational actions such as deployment, browser access, GitHub checks, and notifications. Misrepresenting an operational skill as primarily conceptual can cause underestimation of the permissions and risks involved, weakening informed consent and review rigor.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description begins in Chinese and the README continues almost entirely in Chinese, but there is no indication that the skill is China-specific or that users can choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README explicitly claims the skill is 'documentation-only', requires no credentials, and does not access external services, yet later documents sub-skills for production deployment, browser testing, GitHub integration, and multi-channel notifications. This is a transparency and trust-boundary problem: users or security reviewers may approve or install the skill under false assumptions about its operational scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

git clone https://github.com/openclaw/gstack-openclaw ~/.openclaw/skills/gstack

2. 复制技能文件

mkdir -p ~/.openclaw/skills/gstack cp ~/.openclaw/skills/gstack/SKILL.md ~/.openclaw/skills/gstack/

text

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

2. 复制技能文件

mkdir -p ~/.openclaw/skills/gstack cp ~/.openclaw/skills/gstack/SKILL.md ~/.openclaw/skills/gstack/

text

### 验证安装

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 55)May include surrounding context.

✅ 手动安装

bash
mkdir -p ~/.openclaw/skills/gstack
cp SKILL.md ~/.openclaw/skills/gstack/

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The metadata claims install.sh was removed to eliminate suspicious warnings, but the body still tells users to execute ./install.sh. This inconsistency undermines trust signals and can cause users or reviewers to believe risky script execution has been removed when it has not, enabling deceptive distribution practices.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document explicitly assures users that the skill is documentation-only, contains no executable code, and has no installation script, yet later instructs users to run ./install.sh manually. This contradiction can mislead users into executing local code under a false sense of safety, which materially increases social-engineering risk even if the script content is not shown in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The installation instructions direct users to clone a repository into a sensitive local skills path and execute ./install.sh without any explanation of what the script changes or any caution about reviewing it first. Even in a documentation file, this is dangerous because it normalizes blind execution of repository-supplied shell code on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

文件的名称、描述、使用方式、示例和输出模板全部以中文呈现，未见允许用户选择语言或声明该技能仅面向特定中文场景。根据规则，未经用户选择而强制特定语言/locale 属于自然语言政策违规。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The RUM example collects real-user performance telemetry and POSTs it to an analytics endpoint without any accompanying notice about user data collection, consent, retention, or privacy controls. Even if the metrics are performance-oriented, they can still constitute user telemetry and may create compliance and transparency risks when copied into production without safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly guides automated testing of login flows, includes hardcoded credential examples, and even checks for tokens in localStorage, but it provides no warning about using real accounts, production environments, or handling sensitive session data. In an agent setting, this omission can normalize unsafe interaction with credentials and increase the risk of exposing secrets, session tokens, or modifying real accounts during browser automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises automatic detection and intelligent rollback/continue decisions without a clear warning that these actions may affect live production traffic. In production-release contexts, undocumented autonomous control can lead users or orchestrating agents to invoke the skill assuming advisory behavior when it may instead influence rollout decisions with real operational consequences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The anomaly example contains an internal contradiction: it marks P95 latency at +121% against a '>150%' danger threshold as having triggered a rollback condition, but then recommends only extending monitoring. In a deployment-governance skill, contradictory decision logic can cause operators or downstream agents to take the wrong action during an incident, increasing outage duration or causing unsafe promotion/rollback behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The auto-triggered anomaly-handling example describes unattended monitoring followed by automated continuation or rollback, but does not clearly warn about the operational impact of such autonomy. This is dangerous because readers or integrating agents may treat the example as approved behavior and wire it into production workflows without appropriate approval gates, causing accidental rollbacks or unsafe releases.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written entirely in Chinese and the skill consistently presents its role, instructions, examples, and output format in Chinese, which implies a fixed language expectation. The file does not offer multilingual support, user opt-in, or any justification that this skill is region-specific, so it violates the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown skill file forces a specific language/locale in its natural-language interface, role description, usage examples, and output templates. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is entirely in Chinese and presents the skill persona and behavior as Chinese-language by default, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the main instructional content are written entirely in Chinese, and the skill framing presents the assistant role in Chinese without any indication that users may choose another language. This creates a natural-language locale constraint that is not opt-in and is not justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The visible skill description is written entirely in Chinese, and the rest of the instructions and examples also consistently assume Chinese usage. There is no indication that users may choose another language or locale, which can violate a language/locale policy requiring user opt-in rather than a forced language default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill is written entirely in Chinese, including the description, usage, methodology, and examples, with no indication that users may choose another language. The policy requires flagging language/locale constraints when a skill forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · _skills/investigate/SKILL.md (reported line 327)May include surrounding context.

md
> ### 第 2 步: 假设 1 - 网络问题
> **验证**: 测试到 Stripe API 的网络连通性
> ```bash
> curl -I https://api.stripe.com/v1/charges
> ```
> **结果**: ✅ 网络正常，响应 200ms
>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly frames itself as a one-command workflow to merge PRs and deploy to production, but it does not present any prominent warning, confirmation gate, or requirement for explicit human authorization before performing live production changes. In an agent context, this increases the chance of accidental or over-broad execution of high-impact actions that can directly affect availability, integrity, and release safety.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · _skills/docs/SKILL.md (reported line 179)May include surrounding context.

bash
# 1. 基础可用性检查
curl -sf https://api.example.com/health || exit 1

# 2. 核心功能检查
curl -sf https://api.example.com/api/users/me || exit 1

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
_skills/browse/SKILL.md:147

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
_skills/review/SKILL.md:252

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
_skills/security/SKILL.md:94

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
_skills/test/SKILL.md:304