ClawHub
Back to skill

Security audit

OpenFunderse Strategy

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it handles wallet private keys, financial actions, remote installer code, and global OpenClaw configuration in ways users should review carefully before use.

Install only in an isolated OpenClaw environment with a dedicated low-value participant wallet, not a treasury or admin key. Review or pin the installer provenance where possible, avoid the floating latest install path for production, restrict permissions on OpenClaw config and wallet backup files, consider disabling env sync and gateway restart until reviewed, and confirm whether deposit/withdraw/redeem commands are intended before enabling this skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:6
Finding

Remote npm Package Execution Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:58
Finding

Participant Wallet Private Key Stored in Plaintext Shared Configuration

Content
View full analysis
`env.vars`) or in `~/.openclaw/workspace/.env.participant`. You do not need to run `bot-init`. ``` ```markdown ### Environment Source of Truth (Hard Rule) - In OpenClaw runtime on Ubuntu, treat `/home/ubuntu/.openclaw/openclaw.json` (`env.vars`) as the canonical env source. - Do not require manual `.env` sourcing for normal skill execution. - If `.env*` and `openclaw.json` disagree, use `openclaw.json` values. - When user asks env setup, direct them to update `openclaw.json` first. ``` ```bash set -a; source ~/.openclaw/workspace/.env.participant; set +a ``` ### Technical Analysis The Skill instructs users to store the raw participant wallet private ...[truncated 2905 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx clawhub@latest install openfunderse-participant, which fetches and executes the latest published package code without version pinning. This creates a supply-chain risk: if the package is compromised or a malicious update is published, arbitrary code could run during install in an environment that may contain sensitive bot credentials.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill directs users to place PARTICIPANT_PRIVATE_KEY into persistent local configuration files such as /home/ubuntu/.openclaw/openclaw.json and ~/.openclaw/workspace/.env.participant, and also notes syncing into global OpenClaw state. Persisting a private key in plaintext on disk broadens the attack surface to local compromise, backups, logs, or other skills/processes that can read those files, which is especially sensitive because this key authorizes fund-related submissions.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

npx clawhub@latest install openfunderse-participant

text

2) Optional: create or rotate a dedicated participant signer key.

If you already have a key, set `PARTICIPANT_PRIVATE_KEY` and `PARTICIPANT_ADDRESS` directly in OpenClaw env (`/home/ubuntu/.openclaw/openclaw.json` -> `env.vars`) or in `~/.openclaw/workspace/.env.participant`. You do not need to run `bot-init`.

Static analysis

No suspicious patterns detected.