ClawHub
Back to skill

Security audit

Trade Show Contact Finder

Security checks for vulnerabilities and agentic risk

Overview

The skill’s contact-search behavior is mostly coherent, but its install instructions use an unpinned third-party package command that explicitly acknowledges a ClawHub risk warning.

Review the package provenance before installing, preferably use a pinned audited version, and only provide LENSMOR_API_KEY if you intend the agent to query Lensmor for company contact records. Be aware the skill may be invoked by broad 'find contacts' phrasing unless your agent asks for confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding

Unpinned Third-Party Skill Installation with Risk-Warning Bypass

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 29–33
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
## Install

```bash
openclaw skills install @weilun88313/trade-show-contact-finder --acknowledge-clawhub-risk
text

### Technical Analysis

The documented installation command retrieves a third-party registry package without pinning an audited version or specifying an integrity digest or trusted signature. It also uses `--acknowledge-clawhub-risk`, which explicitly bypasses or acknowledges the registry's risk warning.

The package publisher scope, `@weilun88313`, differs from the Lensmor organization presented as the project owner elsewhere in the documentation. This does not by itself prove malicious ownership, but it weakens provenance assurance and increases the need for verifiable publisher identity, immutable versioning, and package integrity controls.

Because the command resolves mutable registry content at installation time, the installed Skill could differ from the files covered by this audit. A compromised publisher account, malicious future release, registry compromise, or ownership transfer could therefore introduce altered instructions or executable content.

### Attack Path

1. An attacker compromises the registry publisher account, package publication process, or upstream registry.
2. The attacker publishes a modified release under `@weilun88313/trade-show-contact-finder`.
3. The victim follows the README and runs the installation command without a version or integrity pin.
4. The `--acknowledge-clawhub-risk` option permits installation despite the displayed risk warning.
5. OpenClaw resolves and installs the attacker-controlled current package rather than a release matching the audited repository.
6. Any malicious instructions or executable components in that release operate within the permissions available to the Skill runtime.

### Impact Assessment
...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installation command to a specific, audited package version rather than resolving the latest release.
  2. Publish and verify a cryptographic digest or trusted signature for the package artifact.
  3. Remove --acknowledge-clawhub-risk after resolving the condition that causes the registry warning. If it remains necessary, clearly document the warning, its cause, and the independent verification process users must follow.
  4. Publish the package under a verifiably official Lensmor organization or document and cryptographically verify the relationship between Lensmor and the current publisher scope.
  5. Configure continuous integration to compare the published package contents against the tagged source release.
  6. Recommend least-privilege runtime permissions and review the installed artifact before granting access to environment secrets, network tools, or execution capabilities.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
- Find more event companies → `trade-show-exhibitor-search`
- Rank event accounts when recommendation evidence exists → `trade-show-lead-recommender`

## Output Rules

1. Never output `LENSMOR_API_KEY` or raw authorization headers.
2. Never invent contacts, titles, departments, or seniority.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md
- Lensmor API key (`sk_your_api_key`) from Lensmor Settings → API Keys
- Base URL: `https://platform.lensmor.com`
- [Lensmor API docs](https://api.lensmor.com/)

## Install

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description contains very broad multilingual trigger phrases such as generic requests to 'find contacts' or 'who should I contact', which can match ordinary user intent outside a narrowly scoped trade-show workflow. This can cause unintended invocation or over-selection of the skill, increasing the chance that contact-enrichment actions are triggered in contexts where the user did not clearly request this specific integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The description hard-codes trigger phrases in Chinese, German, Japanese, Spanish, and English, but does not explain language selection or indicate user opt-in for locale behavior. This can be read as a fixed multilingual locale policy rather than an explicit user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.