ClawHub
Back to skill

Security audit

OpenClaw OneBot

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent QQ messaging channel skill, with disclosed message, media, token, and filtering behavior, but users should install only from trusted/pinned sources.

Install this only if you trust the OpenClaw plugin source and the QQ bot framework you connect it to. Use a strong access token, keep OneBot endpoints on localhost or a trusted network, configure allowFrom narrowly instead of using '*', and point sharedDir at a dedicated media directory rather than personal folders.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:60
Finding
Unpinned and Unverifiable External Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60-70`, `SKILL.md:242`, `README.md:67-77`, `README.md:254`, `README.md:267` **Vulnerability Type**: Supply-chain exposure through unpinned external packages, scripts, npm dependencies, and a mutable container image **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:60-70`: ```bash # Recommended: install the published ClawHub payload openclaw plugins install clawhub:openclaw-onebot-plugin # Auto install; does not patch the local OpenClaw CLI dist by default bash scripts/install.sh # Or prepare a local payload after reviewing the source npm install && npm run prepare:clawhub:plugin openclaw plugins install .clawhub-plugin/openclaw-onebot-plugin ``` `README.md:248-259`: ```yaml # docker-compose.yml services: napcat: image: mlikiowa/napcat-docker:latest restart: always ports: - "3001:3001" # OneBot 11 WS + HTTP - "6099:6099" # WebUI volumes: - ./napcat-data:/app/.config/QQ - ./shared:/shared # File sharing directory ``` `README.md:267` and `SKILL.md:242`: ```bash npm install ``` ### Technical Analysis The documented installation process downloads or executes external components without pinning them to immutable versions, commit identifiers, cryptographic hashes, or container digests. In particular: - `openclaw plugins install clawhub:openclaw-onebot-plugin` does not specify an immutable plugin version or verified digest. - `npm install` may resolve dependency versions from an external registry and can execute package lifecycle scripts unless separately restricted. - `mlikiowa/napcat-docker:latest` is a mutable image reference whose contents can change without any modification to this audited artifact. - `scripts/install.sh`, `package.json`, dependency lockfiles, plugin source code, and the generated plugin payload are absent from the audited project. Consequently, the behavior of the executable components and the documentation's secu ...[truncated 2223 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Include the complete plugin implementation, `package.json`, lockfile, installation scripts, and generated payload metadata in the auditable release artifact. 2. Pin the ClawHub plugin to a specific immutable version and, where supported, verify a cryptographic checksum or signature before installation. 3. Replace the mutable Docker tag with an immutable image digest, for example: ```yaml image: mlikiowa/napcat-docker@sha256:<verified-digest> ``` 4. Commit and enforce a dependency lockfile. Prefer: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, document each required script and review it before enabling scripts. 5. Publish SHA-256 checksums and signed release attestations for plugin archives, installation scripts, and container images. 6. Add installation instructions that verify downloaded artifacts against the publisher's trusted signing key. 7. Avoid invoking a repository installation script unless that exact script is included in the reviewed artifact and its expected behavior is documented. 8. Run the plugin and NapCat container with least privilege, a read-restricted dedicated shared directory, minimal network access, and only the mounts necessary for operation. 9. Use a strong OneBot access token, keep HTTP and WebSocket endpoints on localhost or a trusted network, and rotate credentials if a retrieved dependency is suspected of compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Credential Access

High
Category
Privilege Escalation
Content
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The README explicitly presents only Chinese and English language options via the document navigation. Under the stated policy, language constraints should either offer user choice or be clearly justified; this file hard-codes the available locales without explaining why other locales are excluded.

Static analysis

No suspicious patterns detected.