Security audit

Clawhub

Security checks for vulnerabilities and agentic risk

Overview

This skill manager is purpose-aligned, but it can install or update public third-party skills into the highest-precedence OpenClaw skill path with limited enforced review or pinning.

Review the exact skill slug, publisher, files, and version before installation or update. Avoid update --all unless you intend to refresh every installed skill, and treat WhatsApp-initiated installs as local software changes that should require explicit confirmation. Prefer pinned versions or verified digests when available.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Global Installation of a Mutable Third-Party Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify the expected package digest, registry identity, and provenance before installation. 3. Prefer a project-local installation with a lockfile over a global installation where operationally possible. 4. Review the package and its dependency tree before approving version upgrades. 5. Disable npm lifecycle scripts during installation when the package's documented functionality permits it: ```bash npm install --global --ignore-scripts clawhub@ ``` 6. Execute the CLI with the least-privileged account and avoid using `sudo` or an administrator shell. 7. Require renewed review and explicit approval whenever the pinned version changes. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:20
Finding: Untrusted Registry Skills Can Be Installed into the Highest-Precedence Skill Directory Without Mandatory Review
Content: View full analysis
``` - `` is the skill identifier from ClawHub (e.g. `summarize`, `weather`, `coding-agent`) - Skills are installed into `./skills/` under the workspace - A new OpenClaw session is needed to pick up the skill ``` ```markdown ## Workflow 1. Ensure `clawhub` CLI is installed (check with `which clawhub`, install if missing) 2. `cd` to the workspace directory: `~/.openclaw/workspace` 3. Run the appropriate `clawhub` command 4. Inform the user to start a new session (or restart gateway) for the skill to take effect ``` ```markdown ## Installing via WhatsApp Users can install skills by messaging the OpenClaw agent on WhatsApp: ``` clawhub install ``` Example: `clawhub install summarize` The agent will handle CLI installation and confirm when the skill is ready. ## Notes - All ClawHub skills are public and open - Treat third-party skills as untrusted — review before enabling - Workspace skills (`/skills/`) take highest precedence over managed and bundled skills ``` ### Technical Analysis The workflow installs third-party registry content directly into `~/.openclaw/workspace/skills/`, which the document explicitly identifies as the highest-precedence skill location. The workflow then instructs the user to begin a new session or restart the gateway so that the installed skill is loaded. Although the notes recommend treating third-party skills as untrusted and reviewing them before enabling them, review is not an enforced workflow step. There is no requirement to pin an immutable version or digest, stage the package outside the active directory, inspect every installed file, validate provenance, or obtain approval after revie ...[truncated 2204 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Self-Modification

High

Category: Rogue Agent
Confidence: 92% confidence
Finding: The skill explicitly supports updating installed skills, which is a form of self-modification because it changes the agent's available code/instructions after initial setup. This is especially sensitive in a skill manager for a public registry, because updates can introduce new behavior from third-party sources into future sessions if provenance, pinning, and review are not enforced.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
clawhub search ""

text
### Update skills ```bash # Update a specific skill

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L18 explicitly says "Do not auto-install without user confirmation," but L73 later states "The agent will handle CLI installation," implying automatic installation as part of the flow. These instructions describe conflicting intent about whether installing the prerequisite CLI is allowed without separate confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The install instructions direct the agent to fetch and place third-party skills into the workspace without a clear, explicit warning at the point of action that this introduces untrusted code with high precedence. In an agent context, that can lead users to authorize installation without understanding that future sessions may load attacker-controlled instructions from the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The WhatsApp flow says 'The agent will handle CLI installation' but does not clearly disclose that a chat message can trigger software installation and workspace modification automatically. In a remote messaging channel, this increases the risk of users unintentionally authorizing third-party code installation with limited visibility into what will be changed.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description says to use the skill when the user wants to "manage ClawHub skills in any way," which is open-ended and lacks clear scope boundaries or exclusion conditions. This broad phrasing may overlap with many general requests about skills and could cause unintended invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.