Security audit

Openclaw Skill Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This skill broadly matches a marketplace installer, but its install and sync flows run an unpinned external CLI and the security notes understate network, download, and file-write behavior.

Review this skill before installing in a sensitive workspace. Its marketplace functions are recognizable, but install and sync depend on an unpinned npx clawhub command and can download or install third-party skills into your OpenClaw skills directory. Prefer a pinned, trusted ClawHub CLI and inspect any skill before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: scripts/install.py:30
Finding: Unpinned Third-Party CLI Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync-from-clawhub.py:84
Finding: Terminal Escape Injection Through Unsanitized Skill Metadata
Content: View full analysis
80 else skill.get('description', '') ) print(f" Description: {desc}") if skill.get('tags'): tags = ', '.join(skill['tags'][:5]) print(f" Tags: {tags}") ``` The traditional and enhanced search implementations similarly print names, descriptions, an ...[truncated 2513 chars]
Remediation: View remediation

other

Note

Location: README_EN.md:39
Finding: Security Documentation Misrepresents Network, Download, and File-Write Behavior
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad marketplace skill with sync, recommendation, advanced search, install, reviews, and leaderboard capabilities. The supplied code only implements browsing/listing behavior. It reads local directories and a local synced-skills JSON file, filters and sorts entries, and prints them. While this partially aligns with the 'browse' aspect of the description, the majority of the highlighted marketplace functionality is absent from this code chunk. Therefore the description materially overstates what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad marketplace/discovery product with recommendation, search, browsing, ranking, and social metadata features. The supplied code chunk only implements installation and local listing of installed skills, delegating installation to the external ClawHub CLI. While 'one-click install' is consistent with part of the description, the primary behavior of this code is much narrower than the declared purpose. There is no evidence here of recommendation logic, marketplace sync, search, Chinese keyword mapping, comments, ratings, or leaderboard functionality. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad marketplace system with synchronization, recommendation, search, installation, review, and ranking features. The provided code chunk does not implement any of these capabilities; it only outputs two static lines related to rankings and explicitly says complete functionality would require additional statistics. This is a material mismatch in primary purpose and implemented functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description portrays a full marketplace with synchronization from ClawHub, discovery/search, installation, reviews, and Top100 rankings. The supplied code only implements a recommendation/display utility based on a local JSON file plus local installed-skill detection. While scenario/industry/role recommendation and fuzzy matching are consistent with part of the description, several headline capabilities are absent. The docstring mentions --keyword, but the actual argparse setup does not define it, so even the claimed keyword search is not implemented in this chunk. Therefore the declared description materially overstates and misrepresents the behavior of this code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code only implements search functionality. It loads either a local skills directory or a previously synced JSON file and performs simple weighted substring matching across selected fields. There is no logic for syncing from ClawHub in this chunk, no recommendation engine, no scenario/industry/identity-based suggestions, no Chinese keyword mapping, and no true fuzzy search. It also does not browse marketplace listings, install skills, manage comments, or produce a Top100 leaderboard; it merely displays search results and prints a suggested install command. Since the declared description presents a broader marketplace with recommendation and enhanced discovery capabilities, while this code chunk is just a basic search tool, the description does not accurately represent the actual behavior of the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code only implements synchronization of a skill list from ClawHub into a local JSON file plus a console summary. It does support the broad declared theme of syncing skills from ClawHub and includes local installed-state detection and popularity display based on download counts. However, most of the declared marketplace functionality is absent from this code chunk: there is no recommendation engine, no scenario/industry/identity recommendation logic, no search implementation, no Chinese keyword mapping, no installation flow, and no rating/comment handling. Additionally, although --category is declared as an argument, it is not applied in the actual fetch command. Therefore the code chunk materially underdelivers relative to the description, so this should be flagged as a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README is written entirely in Chinese and presents usage, safety notes, and examples only in Chinese, without indicating that another language is available or optional. This can violate a language/locale policy when a skill imposes a specific language on users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 73% confidence
Finding: The security section explicitly tells users that install.py invokes npx clawhub install <skill>, again without pinning the package version. Unlike the earlier examples, this line describes actual runtime behavior of the skill's installer workflow, so a compromised or unexpected clawhub package version could affect users during installation through a supply-chain attack path.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities that include shell execution, file reads, and file writes, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent or user will invoke higher-risk operations without clear consent boundaries, especially because the skill also includes installation workflows that modify the local skills directory and invoke external package tooling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The display name and description are written in Chinese and emphasize Chinese keyword support, but the file does not state that the skill is China-specific or offer an opt-in or alternative language. Under the policy, imposing a specific language or locale without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx clawhub without a pinned package version allows execution of whatever package version is current at install time. That creates a supply-chain risk: a compromised, typosquatted, or unexpectedly changed upstream package could execute arbitrary code on the user's system during installation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The security section states that no external code is downloaded, but elsewhere in the same document it acknowledges that install.py causes npx clawhub install to fetch and install skills. This contradiction can mislead users into approving execution under false assumptions, weakening informed consent around remote code retrieval and execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This is another documented invocation of npx clawhub without version pinning, which exposes users to upstream package substitution or malicious updates. Because the command is tied to skill installation, a bad package could directly lead to arbitrary code execution and filesystem changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Referencing npx clawhub unpinned in the security/system-operation documentation normalizes execution of an unversioned remote package. In a marketplace/install context, this is especially risky because users are encouraged to run it as part of normal operation and may not recognize the supply-chain trust boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language descriptions, keys, and category labels are presented only in Chinese, which can effectively impose a single language/locale on users or operators consuming this skill metadata. The file does not offer an alternative language, locale selection, or documentation that this is intentionally limited to a Chinese-speaking region.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON manifest defines recommendation buckets such as "日常办公", "开发编程", and role/industry labels that are very broad, but provides no explicit trigger constraints, invocation context, or negative examples. In a skill-selection or auto-recommendation system, such generic labels can overlap with common user intents and cause unintended or overly aggressive skill recommendations.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/install.py (reported line 33)May include surrounding context.
python
def check_clawhub_installed(): """检查 ClawHub CLI 是否已安装""" try: result = subprocess.run(['npx', 'clawhub', '--version'], capture_output=True, text=True) return result.returncode == 0 except Exception: return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 82% confidence
Finding: The code invokes 'npx clawhub install' on a user-supplied skill name, which causes retrieval and installation of remote content with local filesystem effects. Although shell injection is mitigated by passing a list to subprocess.run, this is still a supply-chain/trust-boundary issue because the script automates installation of external code or assets into the user's skill directory with no validation, pinning, signature check, or allowlist.
Content: Scanner excerpt · scripts/install.py (reported line 54)May include surrounding context.
python
# 使用 ClawHub CLI 安装 try: log_info("调用 ClawHub CLI 安装...") result = subprocess.run( ['npx', 'clawhub', 'install', skill_name], cwd=str(skills_dir), timeout=120

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The script recommends running 'npx clawhub install ' without pinning a specific version. Unpinned npx execution can fetch whatever version is current at execution time, exposing users to upstream compromise, typosquatting, or malicious updates in the package or its dependency chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This user guidance again instructs execution of an unpinned 'npx clawhub' command, repeating the same supply-chain risk. Because this skill is a marketplace installer whose purpose is to fetch third-party skills, the trust boundary is especially sensitive and the danger is increased by normalizing ad hoc remote installs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module description, CLI help examples, output strings, and comments are written for Chinese-language interaction, and the script presents its results and guidance in Chinese only. Because this code file does not offer user opt-in for language selection or explain a region-specific limitation, it conflicts with the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring and command-line help/output strings are written in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which is present here.
Content: No source excerpt is available for this finding.