ClawHub
Back to skill

Security audit

Openclaw Rappi

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for assisted Rappi ordering, but it asks the agent to automatically install and run unpinned outside software and background services before the user approves that setup.

Review this skill carefully before installing. Only use it if you are comfortable with an agent downloading and running unpinned GitHub/npm code, starting a background local service, and controlling a dedicated logged-in Chrome profile for purchases. Safer use would require a pinned, reviewed install, explicit setup approval, and clear stop/uninstall instructions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:13
Finding

Automatic Retrieval and Execution of Mutable Remote Code

Content
View full analysis
logs/service.out.log 2> logs/service.err.log & fi ``` ### Technical Analysis The skill instructs the agent to bootstrap the local service automatically when its health check fails. It clones code from an external GitHub repository or updates an existing checkout with `git pull`, then immediately executes npm installation, build, startup, and platform installation commands. Neither the repository revision nor a release artifact is pinned to an immutable identifier. There is also no signature, checksum, allowlisted commit, or mandatory source review before execution. Consequently, the code executed during a later invocation can differ from the code available when this skill was audited. Execution opportunities include: - npm lifecycle scripts triggered by `npm install`; - build scripts triggered by `npm run build`; - the downloaded `scripts/install-launchd.sh`; - application startup code triggered by `npm start`. The skill therefore delegates local code execution to mutable remote content. ### Attack Path 1. The local service at `127.0.0.1:4777` is unavailable or deliberately stopped. 2. The skill follows its automatic bootstrap instruction. 3. It clones the current repository state or pulls newly published commits. 4. An upstream maintainer compromise, repository compromise, or malicious update introduces executable code into an npm ...[truncated 877 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:27
Finding

Execution of a Remote Persistence Installer

Content
View full analysis
logs/service.out.log 2> logs/service.err.log & fi ``` ### Technical Analysis On macOS, the skill directly executes a remotely downloaded script named `install-launchd.sh`. Launchd is the native macOS service and startup-job mechanism. An installer for launchd is expected to create or register a LaunchAgent or LaunchDaemon so that the service survives the individual skill invocation and may restart in future sessions. The installer is not present in the audited project, so its exact paths, launch configuration, privileges, cleanup behavior, and persistence scope cannot be verified. It is also obtained from the mutable repository described in the preceding finding. On non-macOS systems, the service is detached with `nohup`, causing it to continue after the invoking shell exits. Although `nohup` alone does not establish reboot persistence, it still creates a long-running process without an explicit lifecycle, process identifier record, or cleanup instruction. ### Attack Path 1. The Rappi service health check fails on macOS. 2. The skill clones or updates the external repository. 3. The skill executes the repository-controlled `scripts/install-launchd.sh`. 4. The script registers a launchd job under the permissions available to the agent. 5. The service continues or restarts outside the original ordering task. 6. If the upstream script is compromised, the registered job can repeatedly execute attacker-controlled code in later sessions. For non-macOS systems, the corresponding path starts the downloaded service with `nohup`, leaving it running after the setup command returns. ### Impact Assessment The service can remain active beyond the task that justified its executi ...[truncated 537 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unpinned Repository and npm Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to automatically clone code from GitHub, run npm install/build, and start a local service before ordering. This creates a software supply-chain and arbitrary code execution path unrelated to the core transaction flow, allowing unreviewed third-party code to run on the host if the repository or dependencies are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The setup flow explicitly says to bootstrap the service from GitHub automatically before asking the user for help, and then run installation and startup commands. Automatically installing and executing software without a user-facing consent step is dangerous because it can change the environment, persist services, and run attacker-controlled code without informed approval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

Starting the service with nohup or installing launchd creates a background process that can persist beyond the immediate task. Persistent local services expand attack surface, may retain logs or session-related state, and can continue exposing functionality after the user expects the ordering session to be over.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

./scripts/install-launchd.sh else mkdir -p logs nohup npm start > logs/service.out.log 2> logs/service.err.log & fi

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill tells the user/agent to launch Chrome with a remote debugging port and a dedicated profile for an authenticated shopping session. Exposing Chrome DevTools Protocol access can grant powerful browser control and access to session data if any local process or misconfiguration reaches that port, which is especially sensitive in a logged-in commerce context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

  1. Only after the exact approval phrase appears in the current chat or button callback, call:
bash
curl -X POST http://127.0.0.1:4777/drafts/<draftId>/confirm-purchase \
  -H 'Content-Type: application/json' \
  -d '{"approvalText":"APRUEBO COMPRA RAPPI <draftId>","approvedBy":"user"}'

Static analysis

No suspicious patterns detected.