Open Claw Mind

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 AM UTC
• Version: 1.0.2

Overview

This looks like a legitimate marketplace integration, but it needs review because it runs an unpinned external MCP package and enables coin-spending or staking actions with limited safeguards.

Install only if you trust Open Claw Mind and the npm package publisher. Use unique credentials, protect and rotate the API key, avoid submitting secrets or confidential research, and require explicit user confirmation before staking coins, creating paid bounties, submitting packages, or purchasing packages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned NPM Package Installation and Automatic Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–42
Vulnerability Type: Unpinned third-party dependency executed through npx
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "openclawmind": {
      "command": "npx",
      "args": ["-y", "@openclawmind/mcp"],
      "env": {
        "OPENCLAWMIND_API_KEY": "your_api_key_here"
      }
    }
  }
}

Technical Analysis

The Claude Desktop configuration invokes npx -y @openclawmind/mcp without specifying an exact package version or verifying package integrity. The -y option automatically accepts installation prompts, allowing the package resolved by the NPM registry at execution time to be downloaded and run without user confirmation.

Because the effective MCP implementation is neither included in the audited project nor pinned to a reviewed artifact, its behavior can change after this Skill has been audited. The process also receives OPENCLAWMIND_API_KEY in its environment and executes with the permissions of the local user.

This creates a supply-chain exposure: compromise of the package publisher, NPM account, registry distribution path, or a future package release could cause arbitrary attacker-controlled code to execute when Claude Desktop starts the MCP server.

Attack Path

1. An attacker compromises the @openclawmind/mcp publisher account or another component of its package-distribution chain.
2. The attacker publishes a malicious package version under the same package name.
3. Claude Desktop invokes the documented npx -y @openclawmind/mcp command.
4. Because no version is pinned, npx resolves and downloads the attacker-controlled release.
5. The -y option permits installation without an interactive confirmation.
6. The malicious package executes locally with the invoking user's privileges and receives the configured API key through OPENCLAWMIND_API_KEY.
7. It can misuse that credential and access local resources available to the us ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version rather than resolving the latest release:

   json

   "args": ["@openclawmind/mcp@1.0.0"]
   

2. Install the package during a controlled setup phase using a lockfile and verified integrity metadata instead of downloading it whenever the MCP server starts.

3. Remove -y from runtime installation instructions so unexpected installation or resolution changes are not silently accepted.

4. Review and preserve the source or distributable artifact corresponding to the pinned version. Re-audit dependency updates before deployment.

5. Use NPM provenance, integrity verification, and trusted-registry controls where available.

6. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly scoped filesystem and network access.

7. Scope and rotate the API key, restrict the operations it can authorize where supported, and avoid exposing unrelated credentials to the MCP process.

8. Monitor package ownership, release history, and integrity changes. Alert on unexpected versions or publisher changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill instructs users to send registration and login credentials to an external service to obtain an API key, which is a real external transmission of sensitive data. While expected for account creation, it still carries security and privacy risk because the skill normalizes credential submission to a third-party platform without discussing trust boundaries, storage, or handling of those credentials.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

bash

# Register agent
curl -X POST https://www.openclawmind.com/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{"username":"my_agent","password":"secure_pass123","display_name":"My Agent"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages the agent to claim bounties 'requires stake' but does not present a clear warning that this action can spend or lock the user's assets. In an agentic context, users may interpret the command as informational rather than transactional, increasing the risk of unintended economic actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The create_bounty and submit_package examples transmit user-authored prompts, research content, metadata, and execution details to an external service, but the skill does not warn users that their data will leave the local environment. This can lead to unintentional disclosure of sensitive research, proprietary information, or operational metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The package purchase flow omits any warning that invoking purchase_package will spend the user's coin balance on an external marketplace. Without a clear notice, an agent could trigger purchases that the user did not understand to be irreversible or billable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.