ClawHub
Back to skill

Security audit

Flowclaw

Security checks for vulnerabilities and agentic risk

Overview

FlowClaw is a coherent workflow orchestrator, but its approval and production-deployment controls are weaker than the user-facing description implies.

Review before installing. Run it only on loopback or behind strong authentication, protect the executor API key as an approval-capable credential, add authentication to dashboard/metrics if exposed, and do not enable fastlane production deployment until approval/pre-approval checks are enforced server-side. Pin dependencies for production deployments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/workflow-executor.py:1820
Finding

Human Approval Can Be Bypassed Through the Direct Resume Endpoint

Content
View full analysis
_MAX_APPROVED_BY_LEN: approved_by = approved_by[:_MAX_APPROVED_BY_LEN] result = _resume_workflow(run_id, approved_by) return jsonify(result), (200 if result.get("status") == "success" else 400) def _resume_workflow(run_id: str, approved_by: str) -> Dict: """Internal: load saved workflow state and continue execution from saved step.""" state = _load_workflow_state(run_id) if not state: log.warning("No saved state for resume", run_id=run_id) return {"status": "error", "error": f"No saved state found for run_id={run_id}."} if int(time.time()) > state["expires_at"]: _delete_workflow_state(run_id) return {"status": "error", "error": f"Workflow state for run_id={run_i ...[truncated 2810 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/workflows/fastlane-deploy.yaml:1
Finding

Fastlane Production Deployment Does Not Enforce Its Pre-Approval Requirement

Content
View full analysis
Dict: project = cfg.get("project") or self._vars.get("project_name") cwd = cfg.get("cwd") prod_raw = cfg.get("prod", True) if isinstance(prod_raw, bool): prod = prod_raw elif isinstance( ...[truncated 3661 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
src/requirements.txt:1
Finding

Unbounded Dependency Versions Permit Non-Reproducible and Unreviewed Future Installations

Content
View full analysis
=3.0.0 requests>=2.32.0 pyyaml>=6.0 gunicorn>=23.0.0 prometheus_client>=0.20.0 jsonschema>=4.21.0 ``` ### Technical Analysis Every dependency uses a lower-bound constraint with no upper bound, exact version, lockfile, or package hash. A fresh installation may therefore retrieve versions that did not exist and were not reviewed when the Skill was audited. Python package installation executes package build and installation logic. Consequently, compromise of a permitted future release, its maintainer account, or the package distribution channel can result in code execution during setup or at service startup. The package names observed are established packages rather than apparent typosquats, and no current malicious dependency was identified. The confirmed weakness is the lack of reproducible, integrity-verified resolution. ### Attack Path 1. A future dependency release satisfying one of the `>=` constraints is compromised, malicious, or unexpectedly incompatible. 2. A user follows the documented installation command: ```bash pip3 install -r src/requirements.txt ``` 3. The package resolver selects the new permitted release. 4. Package installation or import executes code from that unreviewed release. 5. The code runs with the privileges of the user installing or operating FlowClaw. ### Impact Assessment A compromised dependency could obtain all privileges available to the installation or service account, potentially including: - Reading FlowClaw environment variables and API credentials. - Reading or modifying files in the user’s OpenClaw workspace. - Accessing Notion, Discord, OpenClaw, or Vercel credentials available to the process. - Altering workflow execution or sending arbitrary network requests. - Persisting through modification of user-owned startup o ...[truncated 192 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (115)

Tainted flow: 'DISCORD_BOT_TOKEN' from os.environ.get (line 355, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · src/workflow-executor.py (reported line 1457)May include surrounding context.

python
return {"status": "success", "simulated": True, "note": "DISCORD_BOT_TOKEN not set"}

        try:
            r = requests.post(
                f"{DISCORD_API}/channels/{channel_id}/messages",
                headers={"Authorization": f"Bot {DISCORD_BOT_TOKEN}", "Content-Type": "application/json"},
                json={"content": message},

Tainted flow: 'DISCORD_BOT_TOKEN' from os.environ.get (line 355, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · src/workflow-executor.py (reported line 1980)May include surrounding context.

python
message = message[:DISCORD_MAX_LEN - 3] + "..."

    try:
        r = requests.post(
            f"{DISCORD_API}/channels/{channel_id}/messages",
            headers={"Authorization": f"Bot {DISCORD_BOT_TOKEN}", "Content-Type": "application/json"},
            json={"content": message},

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 51)May include surrounding context.

md
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 79)May include surrounding context.

md
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 71)May include surrounding context.

python
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 191)May include surrounding context.

python
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 228)May include surrounding context.

python
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 430)May include surrounding context.

python
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 449)May include surrounding context.

python
**`tests/test_security.py`:**
- `TestSafePathFunction`: Replaced hardcoded `/tmp/flowclaw` Unix paths with `tempfile.mkdtemp()`.
  - Tests now correctly handle macOS (where `/tmp` is a symlink to `/private/tmp`) and any CI host.
  - `test_safe_path_rejects_absolute_escape`: Updated to use `os.path.dirname(tmpdir)` instead of a hardcoded `/etc/passwd` path.
  - Added `setUp`/`tearDown` lifecycle to clean up temp dirs after each test.

**`README.md`:**

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose understates materially sensitive behavior: the implementation appears to expose an HTTP API, metrics/dashboard surfaces, persistence, external mutation endpoints, and concrete agent/CLI execution. This mismatch is dangerous because reviewers may approve or deploy the skill without understanding that it can accept remote requests, alter third-party systems, store workflow state, and spawn backend execution paths with much greater attack surface than the manifest suggests.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 126)May include surrounding context.

md
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

md
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/example.env (reported line 2)May include surrounding context.

text
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/example.env (reported line 4)May include surrounding context.

text
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/example.env (reported line 7)May include surrounding context.

text
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 14)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 15)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 20)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 31)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 32)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 44)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 58)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scripts/start-workflow-executor.sh (reported line 59)May include surrounding context.

sh
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/workflow-executor.py (reported line 146)May include surrounding context.

python
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/workflow-executor.py (reported line 315)May include surrounding context.

python
# FlowClaw Configuration
# Copy this file to .env and fill in your values.
#
# SECURITY: Never commit your .env file to version control.
# Add ".env" to your .gitignore.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
src/n8n-workflow.json:145