Yang Openclaw Health

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This is a small, manually run OpenClaw health checker whose local diagnostic behavior is mostly disclosed and proportionate, with some install and transparency caveats.

Install only from a trusted source and prefer a pinned clawhub installer version when available. When run, the diagnostic script inspects local OpenClaw files, process or port state, and whether common model API-key environment variables are present; it does not print the key values or send them anywhere in the inspected code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-13
Vulnerability Type: Mutable and unverified third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install yang-openclaw-health

Technical Analysis

The installation instructions invoke clawhub@latest through npx. The latest tag is mutable and does not identify a specific audited package version. Depending on npm and local cache behavior, npx can download the package and execute its command with the privileges of the user performing the installation.

Consequently, the code executed by this instruction may differ from the version available when the Skill was audited. The project does not provide a pinned version, lockfile, integrity hash, or provenance verification for this installation command. This creates a supply-chain trust boundary in which compromise of the npm package, publisher account, release process, or package distribution channel could cause arbitrary code to run during installation.

No evidence in the supplied files establishes that the current clawhub package is malicious. The issue is the unsafe use of a mutable, externally controlled package reference.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious package version and assigns it the npm latest tag.
3. A user follows the documented command in SKILL.md.
4. npx resolves clawhub@latest to the attacker-controlled release and downloads it if a trusted local copy is unavailable.
5. npx executes the package command with the installing user's permissions.
6. The malicious package can access resources available to that user, such as files, environment variables, credentials, and writable configuration directories.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the ...[truncated 505 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an explicitly reviewed package version:

   bash

   npx clawhub@<reviewed-version> install yang-openclaw-health
   

2. Verify the selected version's publisher, repository, release provenance, and npm package contents before recommending execution.
3. Where supported, verify the package against a documented integrity digest or signed provenance statement.
4. Use a lockfile and deterministic dependency installation when integrating the tool into an automated installation workflow.
5. Avoid running the installation command with sudo, an administrator account, or other elevated privileges.
6. Review new package versions before updating the pinned version rather than automatically following the latest tag.
7. Consider documenting a non-executing package inspection step, such as downloading and reviewing the package archive before invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose understates the actual behavior by omitting environment-variable inspection and undeclared shell or process checks. That mismatch is dangerous because users may consent to a simple health check without realizing the skill can inspect sensitive runtime data or execute local commands, increasing the chance of unintended secret exposure or unsafe execution in privileged environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises diagnostic behavior that inherently touches environment data, but the manifest declares no explicit tool scope or permissions. That creates an authorization and transparency gap: users and platforms cannot accurately evaluate what the skill may access, and environment inspection can expose sensitive secrets such as API keys or tokens during troubleshooting.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub@latest install pulls and executes the newest published package at install time, which is a supply-chain risk because behavior can change without review. If the upstream package is compromised or a malicious version is published, users may execute attacker-controlled code simply by following the installation instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The diagnostic script inspects model-provider API key environment variables even though its stated purpose is installation health checking. This creates unnecessary access to sensitive data and can normalize secret probing in a troubleshooting tool, increasing the risk of accidental disclosure through future logging, error handling, or downstream modifications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The top-level documentation frames the script as an installation diagnostics tool, but the implementation also performs runtime host inspection via process lookup and port-usage checks. That behavior is broader than installation-only checking, so the documentation understates what the script actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code executes shell commands via execSync to inspect running processes and open ports, but the file header only generally says it identifies installation issues and does not disclose that it will invoke system utilities like pgrep and lsof. Because subprocess execution is a safety-relevant operation, the script should clearly inform users about these checks before or while performing them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script accesses sensitive environment variables without explicit disclosure, which violates least surprise and may cause users to run a diagnostic tool without realizing it inspects secrets. Even though it only checks presence and does not print values, undisclosed secret access is risky and can become more dangerous if the script evolves or is reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.