ClawHub
Back to skill

Security audit

OpenClaw OneBot

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent QQ messaging channel skill, with disclosed message, media, token, and filtering behavior, but users should install only from trusted/pinned sources.

Install this only if you trust the OpenClaw plugin source and the QQ bot framework you connect it to. Use a strong access token, keep OneBot endpoints on localhost or a trusted network, configure allowFrom narrowly instead of using '*', and point sharedDir at a dedicated media directory rather than personal folders.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:60
Finding

Unpinned and Unverifiable External Executable Dependencies

Content
View full analysis
Remediation
View remediation
``` 4. Commit and enforce a dependency lockfile. Prefer: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, document each required script and review it before enabling scripts. 5. Publish SHA-256 checksums and signed release attestations for plugin archives, installation scripts, and container images. 6. Add installation instructions that verify downloaded artifacts against the publisher's trusted signing key. 7. Avoid invoking a repository installation script unless that exact script is included in the reviewed artifact and its expected behavior is documented. 8. Run the plugin and NapCat container with least privilege, a read-restricted dedicated shared directory, minimal network access, and only the mounts necessary for operation. 9. Use a strong OneBot access token, keep HTTP and WebSocket endpoints on localhost or a trusted network, and rotate credentials if a retrieved dependency is suspected of compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

md
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 318)May include surrounding context.

md
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md
- 🖼️ 图片、语音、文件附件发送
- 🛠️ 通用 `sendMedia` 出站适配，delivery recovery / mirror / message tool 等通路都能发送图片、语音、文件
- 🔄 WebSocket 自动重连（指数退避）
- 🔒 可选 access token 鉴权
- 🎯 `allowFrom` 消息来源过滤（私聊/群聊/用户级别）
- 🛡️ 未配置 `allowFrom` 时 QQ 文本命令不会被授权；需要显式白名单或 `["*"]`
- ✅ 120 个测试用例全部通过

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README explicitly presents only Chinese and English language options via the document navigation. Under the stated policy, language constraints should either offer user choice or be clearly justified; this file hard-codes the available locales without explaining why other locales are excluded.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.