ClawHub
Back to skill

Security audit

Clawflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent multi-agent workflow protocol, but it gives agents broad delegation, message logging, and context-forwarding behavior without enough containment or data-sharing safeguards.

Install only if you are comfortable with agents delegating work to other configured agents, storing message/task history in the workspace, and forwarding prior results between agents. Avoid using it for secrets or regulated data unless you add redaction, retention, sender-authentication, and explicit approval rules for delegation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
agent-loop.md:92
Finding

Untrusted Peer Results Are Propagated as Executable Agent Context

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
agent-loop.md:75
Finding

Unauthenticated Sender Claims Permit Forged Tasks and Replies

Content
View full analysis
/mailbox/inbox/{task-id}-{subtask-id}-reply.md 2. LOCATE TASK - Find task.md matching msg.task_id in /tasks/ - If not found → move to mailbox/archive/ (orphan reply), return - If task.md mode != coordinating → move to mailbox/archive/, return 3. PROCESS REPLY - If msg.status == failed: - Mark subtask as failed in task.md - Mark entire task as failed - Send failure reply to own parent, log to mailbox/outbox/ - Archive message, return - If msg.status == done: - Store results in "Subtask Results" section of task.md - Mark subtask as done - Write result_summary ``` ### Technical Analysis The message protocol places sender identity in a self-declared Markdown frontmatter field named `from`. The documented processing loop dispatches behavior based ...[truncated 2662 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to use shell commands and write persistent workspace files, but it does not declare any explicit tool scope or permissions boundaries. In a multi-agent orchestration skill, that omission is dangerous because it can cause the agent to invoke powerful capabilities implicitly, including dispatching messages to other agents and persisting task data, without clear least-privilege constraints or operator awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance is very broad and tells the system to use this skill for generic multi-agent, planning, dispatch, delegation, or collaboration requests. That over-triggering increases the chance that the skill activates in contexts where message passing, delegation, shell invocation, and persistent logging are unnecessary, expanding attack surface and causing unintended data propagation across agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly defines durable mailbox logging for all incoming and outgoing messages plus per-task state persisted in workspace files, but it provides no user-facing warning, retention limit, or data minimization guidance. In a multi-agent protocol, these logs can accumulate sensitive prompts, intermediate results, identifiers, and cross-agent communications, creating privacy, compliance, and secondary disclosure risks if the workspace is later accessed or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs coordinators to include upstream subtask results in downstream dispatch messages, which can propagate potentially sensitive user data across multiple agents without any consent, minimization, or visibility controls. In a multi-agent orchestration skill, this increases the blast radius of any sensitive content provided to one agent and can expose data to peers that do not strictly need full upstream outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance explicitly tells coordinators to include prior results and to err on the side of sending more context, but it provides no minimization, redaction, or sensitivity checks before sharing data with peer agents. In a multi-agent orchestration skill, this materially increases the chance of oversharing secrets, personal data, proprietary information, or tenant-scoped data to other agents that may not need it, especially under recursive delegation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · init.py (reported line 30)May include surrounding context.

python
def discover_workspace() -> Path | None:
    """Try to get the default workspace from openclaw config."""
    try:
        result = subprocess.run(
            ["openclaw", "config", "get", "agents.defaults.workspace"],
            capture_output=True, text=True, timeout=5,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · init.py (reported line 44)May include surrounding context.

python
def list_agents() -> list[dict] | None:
    """Try to list configured agents via openclaw CLI."""
    try:
        result = subprocess.run(
            ["openclaw", "agents", "list", "--json"],
            capture_output=True, text=True, timeout=5,
        )

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · init.py (reported line 56)May include surrounding context.

python
def init_clawflow(workspace: Path):
    """Create the tasks/ directory inside an OpenClaw workspace."""
    # Create workspace dir if missing (with warning)
    if not workspace.exists():
        print(f"  Warning: Workspace not found at {workspace}")

Static analysis

No suspicious patterns detected.