Security audit

OpenClaw Mobile Pair

Security checks for vulnerabilities and agentic risk

Overview

This skill is for mobile pairing, but it relies on a missing relative PowerShell script that would read a local gateway token while bypassing PowerShell execution policy.

Review this before installing. Only use it if you trust the missing generator script that will be available at runtime, understand where the BFF URL sends data, and are comfortable with a local gateway token being read for pairing-code generation. Prefer a version that bundles or pins the script, avoids execution-policy bypass, resolves scripts from the skill install directory, and documents token handling.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:14
Finding: Unsafe PowerShell Execution-Policy Bypass for an Unavailable Relative Script
Content: View full analysis
" -CopyToClipboard ``` ``` ### Technical Analysis The skill directs the agent to execute `scripts/generate-mobile-pairing.ps1` with PowerShell's execution policy bypassed. However, the audited package contains only `SKILL.md` and `VERSION.txt`; the referenced script is absent. Because `-File` uses a relative path, script resolution may depend on the process's current working directory rather than a verified package directory. If an attacker can create or replace `scripts/generate-mobile-pairing.ps1` at the resolved location, the agent may execute attacker-controlled PowerShell code. The `-ExecutionPolicy Bypass` option suppresses an execution-policy safeguard that could otherwise prevent or warn about execution of an untrusted script. The skill metadata also claims that the operation automatically reads the local gateway token. Since the implementation is unavailable, its handling of that authentication material cannot be audited. It is therefore impossible to verify whether the token would be embedded in the pairing code, copied to the clipboard, written to a file, or transmitted to the supplied BFF endpoint. ### Attack Path 1. The attacker obtains write access to the agent's working directory or otherwise influences the directory from which the relative script path is resolved. 2. The attacker creates a malicious file at `scripts/generate-mobile-pairing.ps1`. 3. A user invokes the mobile-pairing skill. 4. The agent fo ...[truncated 1159 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly states it will automatically read a local gateway token, but the user-facing description and workflow do not clearly warn that a sensitive local credential is being accessed as part of pairing-code generation. This creates a transparency and consent problem: users may invoke the skill without understanding that local authentication material is being read and potentially transformed into a pairing artifact.
Content: No source excerpt is available for this finding.

External Transmission