Security audit

TeamClaw Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TeamClaw setup guide, but it directs users to mutable installers and latest-tag worker images that can execute code that changes after review.

Review this before installing in a sensitive environment. Prefer pinning the TeamClaw package and worker image to reviewed versions or digests, avoid running the installer as an administrator, and deploy Docker or Kubernetes workers with least privilege and only the workspace access they need.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation
install openclaw plugins install @teamclaws/teamclaw@ ``` 2. Avoid `-y` where practical so users can inspect package resolution and installation prompts before execution. 3. Publish the expected package version, registry, integrity hash, and publisher identity in the installation documentation. 4. Require package provenance or signature verification where the selected package manager supports it. 5. Maintain a controlled upgrade process that reviews release notes and package contents before changing the pinned version. 6. Warn users not to run installation commands as root or an administrator unless that privilege is explicitly required. 7. For high-assurance environments, download and inspect the package first, verify its digest, and install it from an approved internal artifact repository. ]]>

T08 · Insecure Dependencies

Warning

Location: references/install-modes.md:79
Finding: Mutable Latest Tag Used for Docker and Kubernetes Worker Images
Content: View full analysis
Remediation: View remediation
" } ``` 2. Publish separate approved digests for Docker and Kubernetes examples and update them only through a documented review process. 3. Verify image signatures and provenance before deployment, using controls such as Sigstore/Cosign or an equivalent trusted mechanism. 4. Configure registry or cluster admission policies to reject mutable tags and unsigned images. 5. Run workers with least privilege: - Use a non-root user. - Drop unnecessary Linux capabilities. - Disable privileged mode. - Use a read-only root filesystem where feasible. - Mount only required workspace paths. - Avoid exposing host sockets such as `/var/run/docker.sock`. 6. Limit worker network access to the controller and other explicitly required destinations. 7. Restrict Kubernetes service-account permissions and avoid automatically mounting service-account tokens unless required. 8. Scan each approved image for known vulnerabilities and secrets before updating the pinned digest. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill recommends executing npx -y @teamclaws/teamclaw without pinning a specific package version, which causes the latest published package to be fetched and run at execution time. If the package is ever compromised, replaced by a malicious release, or if a breaking change is introduced, users may execute unreviewed code directly on their systems; in a setup skill that explicitly guides installation, this context makes the issue more dangerous because users are likely to copy-paste the command verbatim.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The install guidance uses npx -y @teamclaws/teamclaw without pinning a specific version, so each execution may fetch whatever package version is current at the time. Because this command installs and runs code from a registry, a compromised publisher account, malicious release, dependency hijack, or unexpected breaking update could immediately execute on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instructions present a one-line install command but do not clearly warn that it will download, install/update, and execute software on the user's system. In a setup skill, users are likely to copy-paste commands directly, so lack of an explicit warning reduces informed consent and increases the chance they run unreviewed code with unexpected side effects.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.