ClawHub
Back to skill

Security audit

AgentGate - Enterprise Security Firewall for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed security wrapper, but it routes sensitive tool-call details through an external service and an unpinned npm package, so it should be reviewed carefully before installation.

Install only if you are comfortable sending tool names and full tool arguments to AgentGate's hosted service and relying on its audit log, retention, and tenant isolation. For sensitive agents, ask for pinned package versions, source or provenance, redaction controls, retention/deletion details, and a local or self-hosted policy-evaluation option.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:18
Finding

Unredacted tool arguments are transmitted to an external policy service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-20
Vulnerability Type: Sensitive data exposure through remote policy evaluation
Risk Level: High

Vulnerable snippet:

markdown
## Architecture

AgentGate wraps the agent executeTool method using a middleware pattern. On every tool invocation it sends a POST request to the AgentGate Firebase Cloud Function with the agent API key, tool name, and serialized arguments. The function validates the key, evaluates regex policies, writes to the audit log, and returns the decision in under 80ms.

Technical Analysis

The described middleware transmits the agent API key, tool name, and complete serialized arguments for every tool invocation to externally operated infrastructure. The supported tools include shell execution, filesystem access, browser automation, email, payment APIs, and outbound HTTP requests. Their arguments may contain credentials, authorization headers, private file contents, personal information, email content, payment information, session tokens, or confidential commands.

Although remote policy evaluation is part of the declared firewall functionality, transmitting complete arguments exceeds minimum privilege when a policy only needs a limited subset of fields. The documentation does not describe client-side redaction, schema-based field selection, secret detection, payload encryption beyond the use of HTTPS, configurable logging, retention limits, or a local evaluation mode. It also states that events are written to a remote audit log, increasing the duration and scope of exposure.

Attack Path

  1. A user installs and configures the AgentGate wrapper.
  2. The wrapper intercepts every invocation of supported tools.
  3. An invocation contains sensitive information, such as a shell command with a token, private filesystem content, an email body, or payment parameters.
  4. The wrapper serializes the complete argument object and submits ...[truncated 1038 chars]
Remediation
View remediation

Remediation Suggestions

  • Evaluate policies locally by default so raw tool arguments do not leave the user's environment.
  • If remote evaluation is necessary, define strict per-tool schemas and transmit only fields required by the applicable policy.
  • Redact API keys, passwords, authorization headers, cookies, URL query tokens, private file contents, email bodies, and payment data before transmission.
  • Use pseudonymous identifiers or keyed hashes when policies only require equality or pattern matching.
  • Disable remote payload logging by default and provide explicit controls for retention, deletion, data residency, and audit access.
  • Clearly document all endpoints, subprocessors, stored fields, retention periods, and administrative access boundaries.
  • Encrypt data in transit and at rest, isolate tenants, apply least-privilege database rules, and maintain access logs.
  • Support customer-hosted evaluation endpoints and an offline policy engine for sensitive environments.
  • Require explicit informed opt-in before transmitting argument content.
  • Authenticate and cryptographically bind policy responses to the request, and provide a documented fail-safe behavior for unavailable or invalid remote responses.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:59
Finding

Security-critical npm dependency is installed without version or integrity pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-63
Vulnerability Type: Unpinned third-party dependency with privileged tool interception
Risk Level: Medium

Vulnerable snippet:

markdown
## SDK usage

npm install @agentgate/openclaw-guard

import OpenClaw from 'openclaw';

The same unpinned installation instruction is repeated at lines 85-90:

markdown
## Getting started

1. Sign up free at https://agent-gate-rho.vercel.app
2. Create an agent and copy the API key
3. npm install @agentgate/openclaw-guard
4. Wrap your agent with withAgentGate

Technical Analysis

The installation command does not specify an exact package version or integrity value. Consequently, npm resolves whichever release is current under the applicable registry and configuration when the command is run.

This dependency is particularly security-sensitive because the documentation instructs users to let it wrap the agent's tool execution method. It can therefore observe tool names and arguments and influence whether privileged operations execute. The reviewed project contains no implementation source, lockfile, checksum, signature, provenance information, or package-content verification from which the installed behavior can be validated.

This finding does not establish that the named package is malicious. The risk arises because future installation behavior can change independently of the reviewed SKILL.md, including through package-account compromise, malicious package updates, registry compromise, or unsafe npm lifecycle scripts.

Attack Path

  1. An attacker compromises the package publisher account, release process, or relevant registry path and publishes a malicious release.
  2. A user follows the documented unpinned npm install @agentgate/openclaw-guard command.
  3. npm resolves and installs the compromised current release; any enabled lifecycle scripts may run during installation.

...[truncated 981 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version rather than using an unconstrained install command.
  • Commit a lockfile containing registry-resolved integrity hashes and verify it in continuous integration.
  • Publish or link to auditable source code corresponding exactly to the distributed package.
  • Use npm package provenance or cryptographic signatures and verify publisher identity before installation.
  • Review package contents, transitive dependencies, and lifecycle scripts before recommending the dependency.
  • Disable lifecycle scripts during installation where they are unnecessary, for example through an appropriate ignore-scripts policy.
  • Use dependency scanning and automated alerts, but require manual security review before upgrading this privileged package.
  • Minimize the wrapper process's operating-system permissions and isolate it from unrelated credentials and files.
  • Repeat the same pinned installation command consistently in both the SDK usage and getting-started sections.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.