Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it advertises, but it handles a wallet private key and paid API calls with weak guardrails and an unpinned payment SDK.

Install only with a dedicated low-balance Base wallet, not a primary wallet. Treat every invocation as potentially spending USDC, avoid automatic chained use without a budget, and verify the claw402 SDK version and gateway destination before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:20
Finding: Unpinned Third-Party Payment SDK Receives a Wallet Private Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/query.mjs:20
Finding: Unrestricted Gateway Override Is Combined with Wallet-Signing Capability
Content: View full analysis
0) params[arg.slice(0, idx)] = arg.slice(idx + 1) } const qs = new URLSearchParams(params).toString() const url = `${gateway}${path}${qs ? '?' + qs : ''}` data = await client._get(path, params) console.log(JSON.stringify({ status: 200, url, data }, null, 2)) } ``` ### Technical Analysis `CLAW402_GATEWAY` can replace the documented `https://claw402.ai` service with any supplied string. The script does not enforce HTTPS, validate the destination hostname, restrict ports, or apply an origin allowlist before constructing a client that also receives the wallet private key. The script delegates payment negotiation and signing to the SDK without locally visible validation of: - The blockchain network. - The payment token. - The recipient address. - The requested amount. - A maximum per-call or per-session cost. - Whether the destination is the expected service. The configurable gateway may be useful for development or self-hosting, but unrestricted endpoint selection exceeds the minimum network authority needed for the ...[truncated 2408 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (114)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Although pricing is listed, the skill does not present a clear user-facing warning that every invocation can spend funds from the user's wallet. Because the skill encourages chaining multiple calls and emphasizes frictionless payment, users may incur repeated micropayments without informed consent, especially when invoked automatically by an agent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
node scripts/query.mjs <endpoint-path> [key=value ...]

Static analysis

No suspicious patterns detected.