ClawHub
Back to skill

Security audit

Create a Botpress AI agent with the ADK using OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Botpress ADK guide, but its install instructions ask users to execute mutable remote installer scripts directly in a shell.

Review the installation commands before using this skill. Prefer downloading a pinned Botpress ADK release, verifying its checksum or signature from an official source, inspecting the script, and then running it without elevated privileges. The rest of the guide appears to be ordinary Botpress ADK development documentation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:87
Finding

Unverified Remote Shell Installer Execution on macOS and Linux

Content
View full analysis
Remediation
View remediation
/install.sh" # Compare against a checksum published by Botpress through an authenticated channel. echo " install.sh" | sha256sum --check - # Inspect and execute only after successful verification. less install.sh bash install.sh ``` The version and checksum placeholders must be replaced with authentic values published by Botpress; they must not be guessed or copied from an unauthenticated source. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:92
Finding

Unverified Remote PowerShell Installer Execution on Windows

Content
View full analysis
Remediation
View remediation
/install.ps1" Invoke-WebRequest -Uri $Uri -OutFile ".\install.ps1" $ActualHash = (Get-FileHash ".\install.ps1" -Algorithm SHA256).Hash if ($ActualHash -ne "") { throw "Installer checksum verification failed." } Get-AuthenticodeSignature ".\install.ps1" Get-Content ".\install.ps1" & ".\install.ps1" ``` The pinned version, checksum, and expected signing identity must come from authenticated Botpress release information. Execution must stop if integrity or publisher verification fails. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash pattern is a classic command-chaining risk because it turns network-retrieved data directly into executable shell input with no inspection barrier. In a skill intended to guide users step-by-step, this materially increases the chance of unsafe copy-paste execution and magnifies any compromise of the remote source into immediate code execution.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

macOS & Linux:

bash
curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash

Windows (PowerShell):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md
├── agent.json         # Workspace/bot IDs (auto-generated by adk link/dev, add to .gitignore)
├── package.json       # Node.js dependencies and scripts (dev, build, deploy)
├── tsconfig.json      # TypeScript configuration
├── .env               # API keys and secrets (never commit!)
├── .gitignore         # Should include: agent.json, .env, node_modules/, .botpress/
├── src/
│   ├── conversations/ # Handle incoming messages → use execute() for AI responses

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1420)May include surrounding context.

md
├── agent.json         # Workspace/bot IDs (auto-generated by adk link/dev, add to .gitignore)
├── package.json       # Node.js dependencies and scripts (dev, build, deploy)
├── tsconfig.json      # TypeScript configuration
├── .env               # API keys and secrets (never commit!)
├── .gitignore         # Should include: agent.json, .env, node_modules/, .botpress/
├── src/
│   ├── conversations/ # Handle incoming messages → use execute() for AI responses

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs users to execute remote installer scripts fetched over the network via shell/PowerShell without any integrity verification, pinning, or safety warning. Even if this is a common install pattern, it creates a supply-chain execution path where a compromised release asset, account, DNS/TLS interception edge case, or user confusion could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction "Load this skill when working with Botpress ADK projects" is a high-level activation condition without specific trigger phrases, scope boundaries, or exclusion cases. Because it applies to any Botpress ADK work, it is ambiguous when the skill should activate versus when a more specific skill should be used.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The documented install command fetches an external script from GitHub and executes it immediately. This is dangerous because it trusts mutable remote content at execution time; if the upstream asset or delivery path is compromised, users will run attacker-controlled code.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

macOS & Linux:

bash
curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash

Windows (PowerShell):

Static analysis

No suspicious patterns detected.