Privateclaw Plugin Setup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:30 AM UTC
• Version: 1.1.3

Overview

The skill is mostly aligned with PrivateClaw setup, but it defaults to installing a third-party plugin through an unsafe bypass using a mutable latest package.

Review this skill before installing. Only use it if you trust the PrivateClaw publisher and package source, prefer a pinned and verified package version, and require confirmation before running unsafe install overrides, restarting OpenClaw, killing sessions, or kicking participants.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:43

Finding

Unpinned Plugin Dependency Installed with Safety Checks Bypassed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43 and 111–115
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: High

markdown

- Keep `--dangerously-force-unsafe-install` on every manual install path. `openclaw plugins install --dangerously-force-unsafe-install @privateclaw/privateclaw@latest` is the default published install, and if the user already has a local package directory, prefer `openclaw plugins install --dangerously-force-unsafe-install ./packages/privateclaw-provider` over archive installs.

bash

Use the published npm package by default, and keep `--dangerously-force-unsafe-install` on every manual install path:

openclaw plugins install --dangerously-force-unsafe-install @privateclaw/privateclaw@latest
openclaw plugins enable privateclaw

Technical Analysis

The skill explicitly instructs the agent to bypass OpenClaw's installation safety control by using --dangerously-force-unsafe-install. It simultaneously selects the mutable npm tag @latest instead of an exact, reviewed package version.

Consequently, the code installed during a future invocation may differ from the code originally assessed. The project contains no copy of the dependency source, integrity hash, lockfile, or signature through which the effective plugin payload could be verified. Enabling the plugin and restarting OpenClaw then causes the externally supplied component to load in the OpenClaw process context.

This does not prove that the current @privateclaw/privateclaw package is malicious. The vulnerability is the unsafe supply-chain installation policy, which removes a security barrier while trusting a mutable dependency reference.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry delivery path, or another relevant supply-chain component.
2. The attacker publishes a modified version of @privateclaw/privateclaw and assigns it to the latest tag.
3. A ...[truncated 1050 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, without a mutable version range.
2. Record and verify the expected package integrity digest or a trusted cryptographic signature before installation.
3. Remove --dangerously-force-unsafe-install from the default workflow.
4. Investigate and document the precise warning that requires the unsafe override. Resolve the underlying packaging or policy issue rather than permanently bypassing the safeguard.
5. Audit or vendor the plugin source corresponding to the pinned release before enabling it.
6. Run OpenClaw under a dedicated, unprivileged service account with narrowly scoped filesystem and network permissions.
7. Test new plugin releases in an isolated environment before promoting them to production.
8. Require explicit user confirmation if an unsafe override remains unavoidable, clearly identifying the package version, source, and resulting risk.
9. Do not enable or restart OpenClaw if package integrity or provenance verification fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly instructs users to install the plugin with --dangerously-force-unsafe-install and even says to keep that flag on every manual install path. That bypasses normal package safety protections and materially increases the chance of installing malicious or tampered code, especially because the skill defaults to latest-version installs from npm or local paths without any integrity verification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill documents destructive session-management commands such as sessions killall and kick without emphasizing that they terminate active sessions or remove participants. In an agent-executed context, this can cause unintended denial of service, session loss, or user disruption if invoked automatically or without clear confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.