Security audit

Context Hub for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent documentation helper, but it can install an unpinned CLI and send project-derived annotations to an external Context Hub without clearly requiring user approval or redaction.

Install only if you trust the Context Hub CLI source and are comfortable with agents using it during API or SDK work. Before allowing chub annotate, review and sanitize the exact text, avoiding secrets, private code, customer data, internal URLs, request bodies, and environment-specific identifiers; prefer local notes for confidential projects.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned npm Dependency Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:99
Finding: Remote Annotation Workflow Can Disclose Sensitive Project Information
Content: View full analysis
"" ``` ``` The associated example at lines 113-124 demonstrates that runtime and implementation details may be included: ```markdown Good annotation format: - **Symptom:** what broke - **Cause:** why docs/code failed in practice - **Fix:** exact change that worked - **Scope:** version/environment constraints Example: ```bash chub annotate stripe/api "Webhook signature failed in Next.js route handlers; use raw request body before JSON parse. Verified on stripe-node 17.x." ``` ``` ### Technical Analysis The workflow instructs the agent to persist debugging findings through `chub annotate`. This operation communicates with an external Context Hub service. The annotation template explicitly invites a “gotcha + fix + context,” while the quality guidance requests symptoms, causes, exact fixes, and environment constraints. Such information may legitimately contain proprietary code details, internal endpoint names, tenant or customer identifiers, request and response content, stack traces, filesystem paths, authentication material, or other operational data. The Skill does not require a content preview, secret scanning, redaction, or explicit user approval before annotation submission. This is inconsistent with the feedback workflow at lines 106-110, which explicitly says to ask the user before sending feedback: ```markdown 6) Optional quality feedback (ask user before sending) ```bash chub feedback up chub feedback down --label outdated --label wrong-examples ``` ``` Remote documentation retrieval is necessary for the declared doc-first functionality. Uploading project-derived annotations is optional ...[truncated 1839 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.