ClawHub
Back to skill

Security audit

TWZRD Preflight

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it asks users to install a mutable npm package that would sit in the payment-call path and contact a remote preflight service.

Before installing, pin and audit a specific `twzrd-preflight` npm version, verify its publisher/provenance and lifecycle scripts, restrict the OpenClaw runtime's file and credential access, and confirm what transaction or request data is sent to `https://intel.twzrd.xyz`. Treat the plugin as payment-path code rather than ordinary documentation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-14
Vulnerability Type: Unpinned npm dependency and mutable supply-chain input
Risk Level: Medium

Vulnerable Code

markdown
The runtime plugin is installed from npm:

```bash
npm install twzrd-preflight
text

### Technical Analysis

The documented installation command does not specify an exact package version or integrity hash. Consequently, every installation resolves the package version available under the mutable `twzrd-preflight` npm name at installation time.

The project contains no lockfile, vendored package source, checksum, package provenance information, or executable implementation that would allow the downloaded code to be compared with an audited version. npm packages can execute lifecycle scripts during installation and subsequently run with the privileges of the OpenClaw process.

This is especially security-sensitive because the package is intended to operate in the execution path for payment-shaped tool calls and wrap an HTTP client before requests reach a signer. The audit did not establish that the current npm package is malicious; the vulnerability is the unsafe, unverifiable dependency acquisition mechanism.

### Attack Path

1. An attacker compromises the npm publisher account, package repository, release process, or another component of the package's dependency chain.
2. The attacker publishes a malicious version under the existing `twzrd-preflight` package name.
3. An operator follows the documented `npm install twzrd-preflight` command.
4. npm resolves and downloads the attacker-controlled release because no exact version or integrity value is required.
5. Malicious code can execute through npm lifecycle scripts or when OpenClaw loads the installed plugin.
6. The code then runs in the payment-call and HTTP-client execution context available to the OpenClaw process.

### Impact Assessment

Successful exploitatio
...[truncated 737 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed version, for example:
    bash
    npm install --save-exact twzrd-preflight@<audited-version>
  2. Commit a lockfile containing npm integrity metadata and require reproducible, lockfile-enforced installation with npm ci.
  3. Verify the package publisher, source repository, release provenance, and signatures before installation.
  4. Record and validate the expected package archive checksum in the deployment process.
  5. Audit the package source, transitive dependencies, and npm lifecycle scripts for the pinned release.
  6. Disable lifecycle scripts during dependency acquisition where compatible:
    bash
    npm ci --ignore-scripts
  7. Run the plugin under least privilege, isolate it from unnecessary credentials and files, and ensure that payment signing requires an independent authorization boundary.
  8. Use automated dependency monitoring, but require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.