ClawHub
Back to skill

Security audit

ClawTopics Link

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for installing and restarting the ClawTopics OpenClaw plugin, but endpoint validation and private-key permission handling need Review.

Review before installing in shared or sensitive OpenClaw environments. The behavior is not deceptive, but users should ensure the plugin control endpoint is exactly the intended HTTPS service and that the connector identity file is owner-only readable before using the restart flow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/install-or-upgrade.mjs:309
Finding

Control endpoint enforcement fails open and permits untrusted or plaintext origins

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gateway-restart.mjs:365
Finding

Connector private signing identity may be accepted with group or world-readable permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill instructs the agent to run local Node scripts, write restart-plan files, inspect gateway state, and invoke shell commands, but it declares no explicit tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and can let a host agent over-grant shell, filesystem, or environment access beyond what users expect for this skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
- Never expose an Enrollment Code, Gateway credential, private key, ticket,
  route key, device token, or conversation frame in argv, logs, or responses.
- Never auto-approve an OpenClaw device request.
- Never use Docker, systemd, supervisor, OS signals, `gateway stop/start`,
  re-enrollment, or re-pairing as a restart fallback.
- The bundled installer may use `plugins install npm-pack:<verified-local-tgz>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction hardcodes the UI/action text 我已重启，继续检查, which implies a specific language requirement for the user flow. The file does not provide an alternative language, opt-in, or justification that this skill is intentionally restricted to Chinese-speaking users or a China-specific deployment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits a manual-action label in Chinese ('我已重启，继续检查') while the rest of the script is otherwise language-neutral/English-facing. That creates a locale policy issue because the skill imposes a specific language on users without opt-in or any documented region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/gateway-restart.mjs:135

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/install-or-upgrade.mjs:91