OpenClaw Profanity Plugin

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent profanity-moderation plugin, but its examples include automated message deletion, user bans, and moderator notifications without enough guardrail or privacy guidance.

Review this before installing in a real chat workspace. Pin and audit the npm package, run the bot with least privilege, and avoid enabling automatic deletes or bans until you have tested detection quality, moderator review, audit logs, retention limits, and a reversal process. Treat logs and moderator alerts as potentially sensitive because they may include user and channel information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party npm Package Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–13
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

## Installation

```bash
npm install openclaw-profanity

text

### Technical Analysis

The installation instructions retrieve `openclaw-profanity` without specifying an exact, audited version or integrity hash. Consequently, the installed package contents can change after this Skill has been reviewed. The repository contains only documentation and does not include the package implementation, a dependency lockfile, or other material that would allow the effective installation payload and its transitive dependencies to be audited.

npm packages may define lifecycle scripts that execute during installation. No evidence establishes that the current package is malicious or that it currently contains such a script; however, if the package, a future release, its maintainer account, or a transitive dependency is compromised, following the documented command could retrieve and execute attacker-controlled code.

### Attack Path

1. An attacker compromises the package publisher, a relevant dependency, or the package distribution channel and introduces a malicious release.
2. The malicious release becomes the version selected by npm because the installation command does not pin an audited version.
3. A user follows the Skill documentation and runs `npm install openclaw-profanity`.
4. npm downloads the changed package and its dependency graph.
5. If malicious lifecycle scripts are present, they execute during installation; otherwise, malicious package code executes when the plugin is imported or used by the bot.
6. The payload runs with the permissions and environmental access of the user or service performing installation or running the bot.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user or bot service
...[truncated 355 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the floating installation command with an exact version that has been independently reviewed, such as npm install --save-exact openclaw-profanity@<audited-version>.
• Commit and enforce a package lockfile containing registry-resolved integrity hashes.
• Review the package source, published tarball, lifecycle scripts, and transitive dependency tree before recommending the dependency.
• Use npm install --ignore-scripts where lifecycle scripts are unnecessary, and explicitly document any scripts that must be enabled.
• Run dependency installation and the bot under a dedicated, non-privileged account with restricted filesystem, secret, and network access.
• Enable automated dependency monitoring, but require security review before accepting version updates.
• Consider vendoring or otherwise reproducibly pinning the audited artifact when stronger supply-chain assurance is required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Slack example encourages logging and moderator notification for profanity events but does not warn that message text, user identifiers, and channel metadata may be collected and disclosed. In a moderation plugin, this can lead to unreviewed privacy-impacting deployments where sensitive user content is retained or shared beyond the original conversation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples show automated deletion of user messages and banning of users without clear warnings, guardrails, or recommendations for review thresholds. In moderation contexts, such destructive actions can be misconfigured or over-triggered, causing denial of service to legitimate users, accidental censorship, or irreversible enforcement based on false positives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.