ClawHub
Back to skill

Security audit

ClawWall

Security checks for vulnerabilities and agentic risk

Overview

ClawWall is a coherent outbound DLP skill, but its default network exposure and fail-open protection model need review before use.

Review before installing. Prefer binding the service to 127.0.0.1, set blockOnError to true if you rely on it for DLP, install in an isolated environment, and verify downloaded packages or source before running pip/npm build steps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unverified Third-Party Code Is Downloaded and Executed During Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:116
Finding

Local Scanning Service Binds to All Network Interfaces by Default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:93
Finding

Outbound DLP Enforcement Fails Open by Default

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation states that the skill does not make external connections and that plugin registration is manual, yet the installation flow explicitly uses pip, git clone, and npm install, all of which contact external package sources, and clawhub install clawwall installs the skill itself. For a manifest describing a local-only outbound DLP component, this overstates the operational isolation of the skill as delivered through the skill file.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

API Quick Start

bash
curl -s -X POST http://localhost:8642/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"content": "key=AKIAIOSFODNN7EXAMPLE", "destination": "api.example.com"}'

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

The declared requirements include git, node, and npm, while the manifest frames the skill as a local Python service performing hard-regex scanning with no LLM. Those extra toolchain dependencies are only for fetching/building the optional OpenClaw plugin and are broader than the core DLP purpose suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.