T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bundle.cjs:1183- Finding
Authorization API Key Disclosed in Plaintext Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawSentry
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated ClawSentry installation purpose, but it handles credentials and cleanup paths in ways users should review before installing.
Review this skill before installing. It will run a bundled local script, install a remote plugin package, contact Volcengine/ClawSentry authorization services, store login state, enable conversation access for the plugin, and restart the OpenClaw gateway. Avoid running it on shared or sensitive machines unless you accept the credential logging, unpinned install, and cleanup-path risks; rotate any ClawSentry API key if the installer has already produced poll_login.log.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bundle.cjs:1112- Finding
Configuration-Controlled Path Used for Recursive Directory Deletion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/bundle.cjs:1174- Finding
Remote Plugin Installed Without an Exact Version or Integrity Verification
- Content
View full analysis
- Remediation
View remediation
`, rather than relying on the registry's current selection. 2. Verify the downloaded artifact against a published cryptographic digest or trusted signature before installation. 3. Use a lockfile or immutable internal artifact repository with controlled provenance. 4. Reject installation if the resolved version or integrity digest differs from the approved value. 5. Record the approved version and digest in the skill documentation so operators can independently verify them. 6. Apply dependency scanning and provenance checks to the plugin and its transitive dependencies. 7. Review updates before changing the pinned version instead of automatically consuming new releases. 8. Where supported, restrict plugin permissions and conversation access until artifact verification and authorization have both completed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled script (`bundle.cjs`) performs the following operations:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled script (`bundle.cjs`) performs the following operations:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code derives a persistent device fingerprint from machine ID or fallback host characteristics and stores it for reuse, then uses it in requests to the remote service. Persistent host fingerprinting enables long-term tracking and ties account/login activity to a specific machine, which is especially sensitive in an installation helper.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script goes beyond local plugin installation by creating remote login tokens, polling a vendor service, and retrieving identity material used to configure the plugin. In a skill advertised as installation/configuration, this creates an unexpected trust boundary expansion and sends installation-linked identifiers to an external service, which is risky if users are not explicitly informed and consenting.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file provides a concrete invocation phrase only in Chinese ("帮我安装 claw-sentry 插件") and the surrounding instructions are entirely Chinese, which can imply the skill expects or requires that locale. Under SQP-3, forcing a specific language without user opt-in is a policy concern when no alternative language choice or justification is documented.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes shell execution and environment access but does not declare any explicit tool scope or permissions boundaries. This creates a mismatch between documented capabilities and enforceable restrictions, increasing the chance that an agent runs installation commands with broader access than the user expects.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill persists login state, token material, activation URL, and device fingerprint across runs in local state files so it can resume later. Persisting authentication-related state on disk increases exposure to token theft, account linking abuse, or privacy leakage if the files are readable by other local users or retained longer than necessary.
- Content
md The skill uses a bundled CommonJS script (`bundle.cjs`) for installation. This script is executed directly and supports two explicit phases: - **Phase 1 (`--phase init`)**: Install plugin, create login token, print the product authorization activation page link, save local state, and return quickly. - **Phase 2 (`--phase finalize`)**: Read the saved state, perform a short polling window, and finish writing OpenClaw plugin configuration if platform login and activation are complete. If the script is run without `--phase`, it automatically chooses:
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The skill instructs execution of a bundled CommonJS script from an external source that can perform system queries, network communication, file writes, and plugin reconfiguration. Because the actual bundle is opaque in this file and explicitly acknowledged as capable of arbitrary code execution, running it grants broad code-execution capability on the host with limited visibility or constraint.
- Content
md - **Bundled Code:** The script includes bundled third-party libraries, which may execute system-level operations. - **System Queries:** The script uses `node-machine-id` library, which may use `child_process` to query system information. - **Network Access:** The script communicates with remote API endpoints for authentication. - **Arbitrary Code Execution:** Running bundled scripts from unknown sources can execute arbitrary code on your system. ### Security Measures
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill persists login state to disk in a .state directory, including login tokens, device fingerprint, and later writes plugin credentials into OpenClaw configuration. Storing these secrets unencrypted in predictable local paths increases the chance of credential theft, session hijacking, or unauthorized reuse by other local users or processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends a device fingerprint and login token to external HTTPS endpoints as part of token creation and identity lookup without meaningful user-facing disclosure beyond logs. Even if TLS is used, undisclosed transmission of identifiers and auth material is a privacy and trust issue, particularly for a security-related installer.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The polling flow repeatedly transmits persisted login state data, including device fingerprint and token context, to a remote API with no interactive notice except console output. Repeated background-style transmission increases privacy exposure and can be unexpected in a plugin setup flow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The configuration hard-codes language: "zh", which imposes a specific locale on users regardless of their preferences. There is no nearby documentation or runtime choice indicating user opt-in or a justified region-specific requirement for this language restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The messaging describes finalization as 'skill-safe' even though that phase still polls a remote service, writes plugin configuration, and restarts the OpenClaw gateway. Misleading safety framing can reduce user scrutiny and cause operators to approve impactful actions they would otherwise review more carefully.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs users to proceed through an external authorization and automatic configuration flow, but it does not clearly warn up front that the skill will open a third-party page, request account consent, and modify security-related configuration. In a security-plugin installation context, missing consent and change-transparency language can mislead users into approving actions they do not fully understand, increasing social-engineering and unsafe-deployment risk.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md 2. **Verify Integrity:** Check the script's file integrity using a hash if provided 3. **Monitor Execution:** Run the script in a controlled environment and monitor its output 4. **Ensure Trust:** Only run the script if you trust the source of this skill 5. **Check Permissions:** Ensure the script has appropriate file permissions ### Alternative Installation
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/bundle.cjs:1238