ClawKeeper — Tasks & habits in a plain markdown file

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:39 PM UTC
• Version: 0.2.2

Overview

This is a coherent local task and habit manager skill, with practical cautions around shared storage, deletion commands, and its unpinned npm installer.

Install only if you are comfortable trusting the npm `clawkeeper` package. Keep `CLAWKEEPER_DIR` in a private per-user or per-agent location unless you intentionally want shared task data, and confirm exact item IDs before deleting tasks, habits, or notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned and Unaudited npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"openclaw": {"requires": {"bins": ["clawkeeper"], "env": ["CLAWKEEPER_DIR"]}, "primaryEnv": "CLAWKEEPER_DIR", "install": [{"id": "npm", "kind": "node", "package": "clawkeeper", "bins": ["clawkeeper"], "label": "Install via npm"}]}}

Technical Analysis

The installation metadata directs the framework to install the clawkeeper package from npm without specifying an exact version, lockfile, integrity hash, immutable artifact reference, or other provenance constraint. Consequently, the code installed at deployment time may differ from the code originally reviewed.

The dependency's implementation is not included in the audited project, which contains only SKILL.md. Its installation-time scripts and runtime behavior therefore could not be inspected. This does not establish that the current npm package is malicious, but it creates a supply-chain trust boundary that is not adequately controlled.

Because the installed package provides the clawkeeper executable, its code runs with the permissions of the installing or invoking user. It also receives access to the environment and the location identified by CLAWKEEPER_DIR.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another part of the publication process.
2. The attacker publishes a malicious or compromised release under the expected clawkeeper package name.
3. The Skill installation process resolves the package without an exact version or integrity restriction.
4. npm downloads and installs the attacker-controlled release.
5. Malicious code executes through an npm lifecycle script, if present and permitted, or when the installed clawkeeper executable is invoked.
6. The code operates with the invoking user's permissions and can acc ...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawkeeper to a reviewed, exact package version rather than allowing unconstrained resolution.
2. Lock and verify the package artifact using a cryptographic integrity hash.
3. Verify npm publisher identity and package provenance, and prefer signed or attestable releases from a trusted source.
4. Include the dependency source in the review scope or install it from a reviewed, immutable artifact or commit.
5. Disable npm lifecycle scripts during installation where they are unnecessary, then explicitly permit only reviewed setup steps.
6. Run the CLI with least privilege, limit access to CLAWKEEPER_DIR, avoid exposing unrelated secrets through environment variables, and restrict outbound network access where practical.
7. Add automated dependency monitoring and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill states that CLAWKEEPER_DIR lets multiple agents share the same task list, but it does not warn that the directory may contain private notes, habits, and personal metadata accessible to other tools or agent contexts. This can lead to unintended cross-agent disclosure or modification of sensitive personal information if the environment variable points to a shared location.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill exposes destructive delete commands for tasks and habits but provides no guidance to confirm intent, warn the user, or prefer safer identifiers before deletion. In an agent context, fuzzy --text matching plus autonomous execution increases the chance of accidental data loss from ambiguous or mistaken commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.