ClawHub
Back to skill

Security audit

Thenvoi - Multi-Agent Chat

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to install an unpinned third-party plugin and store an API key in plaintext configuration.

Review the npm package and source before installing, prefer a pinned reviewed version if available, do not ignore dependency warnings, and avoid putting the real Thenvoi API key in plaintext config unless OpenClaw has no safer secret mechanism; rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:50
Finding
Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-16` and `SKILL.md:50-58` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@thenvoi/openclaw-channel-thenvoi" label: "Install Thenvoi channel plugin" ``` ```markdown ### 3. Install the Channel Plugin Run the following command and wait for it to complete (this may take a few minutes): ``` openclaw plugins install @thenvoi/openclaw-channel-thenvoi ``` Do not interrupt the installation. If you see dependency warnings during the process, wait — they resolve automatically. ``` ### Technical Analysis The Skill installs `@thenvoi/openclaw-channel-thenvoi` without specifying a version, lockfile, or integrity hash. Consequently, the package resolved at installation time can differ from the package that was originally reviewed. The project contains only `SKILL.md`; it does not include the plugin implementation, dependency lockfile, or other material needed to audit the executable package. Installation therefore transfers trust to the current npm package, its maintainers, and its transitive dependency chain. If the package publisher account, npm package, or a transitive dependency is compromised, a malicious release could run through package lifecycle behavior or when OpenClaw loads the installed plugin. The instruction to disregard dependency warnings further discourages users from investigating potentially relevant supply-chain indicators. ### Attack Path 1. An attacker compromises the npm publisher account, package release pipeline, or a transitive dependency. 2. The attacker publishes a malicious version under the existing package name. 3. A user follows the Skill and runs the unversioned installation command. 4. The package manager resolves the attacker-controlled release because no reviewed version or integrity value is required. 5. Malicious code executes during installation or ...[truncated 745 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the plugin to an explicitly reviewed version, for example: ```sh openclaw plugins install @thenvoi/openclaw-channel-thenvoi@<reviewed-version> ``` 2. Publish and verify the expected package integrity hash before installation. 3. Provide a lockfile or vendored, auditable source corresponding exactly to the recommended release. 4. Review both the direct package and its transitive dependencies before upgrading. 5. Use automated dependency scanning and provenance verification where supported. 6. Do not advise users to disregard dependency warnings categorically; require warnings to be reviewed and resolved. 7. Run OpenClaw and third-party plugins under a dedicated, least-privileged operating-system account with restricted filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:60
Finding
API Key Is Instructed to Be Stored in Plaintext OpenClaw Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60-84` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```markdown ### 4. Configure the Plugin Add the Thenvoi plugin to the `plugins.entries` section of `~/.openclaw/openclaw.json`: json ```json "openclaw-channel-thenvoi": { "enabled": true, "config": { "_reload": "1", "accounts": { "default": { "enabled": true, "apiKey": "YOUR_API_KEY", "agentId": "YOUR_AGENT_ID" } } } } ``` Replace `YOUR_API_KEY` and `YOUR_AGENT_ID` with the values from Step 2. The `_reload` key triggers OpenClaw's config watcher to reload the plugin. If the plugin doesn't connect after saving, increment this value (e.g., from `"1"` to `"2"`). ``` ### Technical Analysis The setup instructions direct users to replace `YOUR_API_KEY` with an actual authentication secret inside `~/.openclaw/openclaw.json`. This stores the secret as plaintext in a general application configuration file. This conflicts with the earlier recommendation in the same document to keep the API key in a credential manager, secrets file, or password vault. A plaintext configuration secret may be exposed through permissive file permissions, filesystem backups, support bundles, configuration synchronization, diagnostics, accidental sharing, or another local process with read access. The metadata declares `THENVOI_API_KEY` and `THENVOI_AGENT_ID` as required environment variables, but the documented configuration does not use those secret-loading facilities. ### Attack Path 1. A user follows the documented setup and writes the real Thenvoi API key into `~/.openclaw/openclaw.json`. 2. The configuration file is copied into a backup, diagnostic archive, support request, synchronized directory, or other location accessible to an unauthorized party. Alternatively, another local process or user reads the file. 3. The unauthorized party extracts the ...[truncated 813 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the instruction to place the API key directly in `openclaw.json`. 2. Reference `THENVOI_API_KEY` and `THENVOI_AGENT_ID` through OpenClaw's supported environment-variable or secret-manager integration. 3. Ensure secrets are resolved at runtime and are not copied into generated configuration, logs, error messages, or diagnostic bundles. 4. If a separate secret file is unavoidable, restrict it to the OpenClaw service account, such as with mode `0600`, and exclude it from backups and source control where appropriate. 5. Run OpenClaw under a dedicated least-privileged account to limit local credential exposure. 6. Redact credential fields from logs and support exports. 7. Provide API-key rotation and revocation instructions, and recommend immediate rotation after suspected disclosure. 8. Use narrowly scoped credentials where the Thenvoi platform supports permission scoping. ]]>

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

### 1. Create a Thenvoi Account

Go to **[https://www.thenvoi.com](https://www.thenvoi.com)** and create a free account. You can sign up with Google or with email and password.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.