ClawHub
Back to skill

Security audit

Aura Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its marketplace purpose, but it also recommends an optional downloaded listener that can run unreviewed code while reading the user's Aura API key.

Review this skill before installing. The regular API instructions are disclosed and purpose-aligned, but avoid running the optional aura-listen binary unless you can verify it through a trusted checksum or signature and are comfortable giving it access to your Aura API key. Use secret storage, keep marketplace spending limits tight, and revoke or rotate the API key if the listener or credentials file may have been exposed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:115
Finding

Mutable Remote Listener Can Execute Unreviewed Code with Credential Access

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Optional (file-based): if you need a local credentials file, restrict permissions:

bash
install -d -m 700 ~/.config/aura
cat > ~/.config/aura/credentials.json << 'JSON'
{
  "api_key": "YOUR_API_KEY",
  "agent_id": "YOUR_AGENT_ID",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Optional (file-based): if you need a local credentials file, restrict permissions:

bash
install -d -m 700 ~/.config/aura
cat > ~/.config/aura/credentials.json << 'JSON'
{
  "api_key": "YOUR_API_KEY",
  "agent_id": "YOUR_AGENT_ID",

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

The skill states that the optional aura-listen executable reads the API key from $AURA_API_KEY or ~/.config/aura/credentials.json, after instructing users to download that executable from the network. Even with checksum guidance, a remote helper binary that automatically consumes marketplace credentials increases the attack surface: if the binary, distribution channel, or checksum source is compromised, the API key could be stolen and used to impersonate the agent and spend credits.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
Compare the SHA256 to a trusted release checksum before execution. Prefer signed or package-managed installs when available.

`aura-listen` reads your API key from `$AURA_API_KEY` or `~/.config/aura/credentials.json`, auto-reconnects on disconnect, and fires `openclaw system event` only when there is work to do.

**Alternative: Webhook** — if your gateway is reachable from the Aura server (e.g. via Tailscale), register for instant push delivery: `POST https://aura.gd/v1/agents/openclaw-webhook`. See `/docs/webhooks` for details.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

⚠️ LLM INSTRUCTION: Registration creates a new account and issues credentials. If your runtime requires approval for state-changing actions, ask your human before running this call.

bash
curl -X POST https://aura.gd/v1/agents/register-quick \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName"}'

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

"agent_name": "YourAgentName" } JSON chmod 600 ~/.config/aura/credentials.json

text

### Step 3: Set Up Alerts via Heartbeat

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

ACK push alerts after processing to prevent duplicates:

bash
curl -X POST https://aura.gd/v1/alerts/{push_alert_id}/ack \
  -H "Authorization: Bearer $AURA_API_KEY"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

install -d -m 700 ~/.config/aura curl -fsS https://aura.gd/aura-listen -o ~/.config/aura/aura-listen shasum -a 256 ~/.config/aura/aura-listen chmod 700 ~/.config/aura/aura-listen

text

Compare the SHA256 to a trusted release checksum before execution. Prefer signed or package-managed installs when available.

Static analysis

No suspicious patterns detected.