ClawHub
Back to skill

Security audit

ieasysell

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its sales-automation purpose, but it asks for a live CRM login token and persists/notifies customer contact data without enough limits or disclosure.

Review this skill carefully before installing. Use it only if you are comfortable giving OpenClaw a sensitive Ieasysell login token, allowing it to modify digital-human reception settings, repeatedly pull visitor records, store recent customer data in memory, and show contact details in notifications. Prefer a scoped, revocable API key and clear customer privacy/retention controls before production use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/skills.ts:19
Finding

Overprivileged browser login token used instead of a scoped API credential

Content
View full analysis

Vulnerability Details

File Location: scripts/skills.ts:19-24, 54, 108-112, 150-154, 180-184, 231-235, 292-295, 423-427
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

ts
const { ieasysellToken, company, product, market = "global", syncInterval = 5 } = config;
ts
const res = await fetch("https://crm.ieasysell.com/client/account/info", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type": "application/json"
  }
});

The same bearer token is also used for digital-human creation, listing, modification, and visitor-record retrieval.

Technical Analysis

The implementation asks the user to retrieve an interactive Ieasysell login token from browser Local Storage and supplies that token as a bearer credential to multiple CRM endpoints. This differs from SKILL.md:21 and claw.json:16-20, which describe a dedicated Ieasysell API key.

An interactive login token may represent the user's broader authenticated session and may authorize more account operations than this Skill requires. The minimum necessary permissions are limited to tenant-information lookup, management of the relevant digital human, and read access to associated visitor records.

No evidence indicates that the token is sent to an unrelated domain: all observed requests use HTTPS and target crm.ieasysell.com. The risk arises from the unnecessarily broad credential placed in Skill configuration and runtime memory rather than malicious third-party exfiltration.

Attack Path

  1. The user signs in to Ieasysell and extracts the login token from browser Local Storage.
  2. The user saves that token in the Skill configuration.
  3. The Skill repeatedly retains and uses the token for authenticated CRM requests.
  4. An attacker who obtains access to OpenClaw configuration, process memory, debugging output, or an insufficientl ...[truncated 849 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the browser login token with a dedicated, revocable API key or OAuth token.
  2. Restrict the credential to the exact required capabilities:
    • Read tenant identity.
    • Create, list, and update only the relevant digital-human resources.
    • Read visitor records associated with that digital human.
  3. Do not instruct users to extract credentials from browser Local Storage.
  4. Store the credential through the platform's protected secret manager rather than ordinary Skill configuration or persistent memory.
  5. Use short-lived access tokens with rotation and independent revocation.
  6. Ensure tokens are redacted from logs, exceptions, notifications, telemetry, and diagnostic output.
  7. Align SKILL.md, claw.json, and the implementation so they consistently specify the same scoped credential type.
  8. On the server, validate tenant and digital-human ownership for every endpoint rather than relying solely on identifiers supplied by the client.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/skills.ts:325
Finding

Persistent storage of complete visitor records containing personal information

Content
View full analysis

Vulnerability Details

File Location: scripts/skills.ts:325-337, 513-526
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

ts
const updatedMemory = {
  last_sync_time: Date.now(),
  visitor_count: (memory.visitor_count || 0) + newRecords.length,
  reception_prompt: await optimizePromptFromVisitors(claw, newRecords),
  last_visitors: newRecords.slice(0, 10),
  company: company,
  digitalHumanId: digitalHumanId,
  tenantId: tenantInfo.tenantId
};

await claw.updateMemory(updatedMemory);

Visitor records can include direct contact information, as demonstrated by the notification-processing logic:

ts
if (visitor.contactInfo) {
  const contacts = [];
  if (visitor.contactInfo.email && visitor.contactInfo.email.length > 0) {
    contacts.push(`📧 ${visitor.contactInfo.email.join(', ')}`);
  }
  if (visitor.contactInfo.phone && visitor.contactInfo.phone.length > 0) {
    contacts.push(`📱 ${visitor.contactInfo.phone.join(', ')}`);
  }
  if (visitor.contactInfo.whatsapp && visitor.contactInfo.whatsapp.length > 0) {
    contacts.push(`💬 ${visitor.contactInfo.whatsapp.join(', ')}`);
  }
  if (contacts.length > 0) {
    contactInfo = contacts.join('\n');
  }
}

Technical Analysis

The Skill copies the ten most recent visitor objects into persistent OpenClaw memory without applying a field allowlist or removing personal information. Based on the same file's processing logic, a visitor object may contain names, email addresses, telephone numbers, WhatsApp identifiers, location information, interaction counts, and intention assessments.

Prompt optimization only uses aggregate country, language, and intention-level information. Notifications can also be generated transiently from the retrieved records. Persisting complete visitor objects therefore exceeds the minimum data required for these func ...[truncated 1588 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not persist complete visitor objects in Agent memory.
  2. Store only the minimum non-sensitive state required for synchronization, such as:
    • Last successfully processed timestamp or opaque cursor.
    • Aggregate visitor count.
    • Aggregated country, language, and intention statistics.
    • Opaque visitor identifiers where deduplication is necessary.
  3. Generate contact-detail notifications transiently and discard the underlying record immediately afterward.
  4. If contact retention is a required feature, use a dedicated encrypted customer-data store rather than general-purpose Agent memory.
  5. Apply a strict field allowlist before any record is persisted.
  6. Define and enforce a short retention period with automatic deletion.
  7. Provide users with explicit controls to inspect, export, and delete retained customer information.
  8. Document the data flow, retention policy, lawful basis, and customer-consent requirements.
  9. Restrict memory and backup access using tenant isolation and least-privilege access controls.
  10. Avoid placing personal information in logs, error messages, prompts, or unrelated future Agent context.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The notification builder assembles and exposes email addresses, phone numbers, WhatsApp details, visit counts, and message counts for forwarding to another recipient. This is a direct disclosure path for personal data and engagement metadata, and misuse or misdelivery could materially harm customer privacy and confidentiality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states that it retains conversations, synchronizes customer data, and notifies the boss in real time, but provides no user-facing notice, consent flow, or data-handling explanation. In a sales and customer communication context, this creates material privacy and compliance risk because personal, commercial, and potentially sensitive customer information may be collected and transmitted without transparency.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match ordinary business conversations, which can cause the skill to activate unintentionally in contexts where the user did not mean to invoke it. Because this skill handles customer reception and data synchronization, accidental activation could lead to unintended data collection, customer engagement actions, or business workflow side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad marketing/business requests rather than narrowly scoped commands, which can cause the skill to activate in response to ordinary conversation unrelated to the user's intent. In a sales/customer-engagement skill, this increases the chance of unintended invocation, data handling, or user confusion about which system is acting.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The top-level description normalizes automatically syncing memory and notifying a boss about visitor-management activity, which implies third-party sharing of customer interaction data. In context, this increases the likelihood of privacy-invasive deployment without adequate disclosure or access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to extract a live login token from browser local storage and paste it into the skill without warning about credential sensitivity, scope, or compromise impact. If that token is exposed through logs, configuration leaks, screenshots, or reuse, an attacker may gain account-level access to the external CRM.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The prompt and strategy text explicitly encourages collecting visitor contact details and using historical interaction data to optimize future responses. Persistently capturing and reusing such data without clear consent, minimization, or retention controls creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/skills.ts (reported line 108)May include surrounding context.

ts
// 用户主动重置：直接生成新数字分身（旧链接自动失效）
        await claw.say(`⚠️ 正在重置你的接待链接，旧链接将自动失效...`);
        
        const createRes = await fetch("https://crm.ieasysell.com/client/digitalHuman/create", {
          method: "POST",
          headers: {
            "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/skills.ts (reported line 231)May include surrounding context.

ts
// 用户主动重置：直接生成新数字分身（旧链接自动失效）
        await claw.say(`⚠️ 正在重置你的接待链接，旧链接将自动失效...`);
        
        const createRes = await fetch("https://crm.ieasysell.com/client/digitalHuman/create", {
          method: "POST",
          headers: {
            "Content-Type": "application/json",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code comment frames the periodic sync as only pulling visitor-management data, but the implementation also stores recent visitor records in memory and constructs notifications that can surface contact details and engagement metadata. This mismatch can mislead users about the scope of collection and disclosure, increasing the risk of unintended personal-data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill starts ongoing synchronization of visitor records and sends notifications containing visitor-derived information without any clear privacy notice, consent workflow, or data-handling explanation. This can result in unauthorized monitoring or disclosure of personal data to the operator or another recipient.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/skills.ts (reported line 292)May include surrounding context.

ts
console.log(`[${new Date().toLocaleString()}] 开始同步访客管理数据...`);
          
          // 从访客管理 API 拉取新访客记录
          const syncRes = await fetch("https://crm.ieasysell.com/client/websocket/visitorInfo/getVisitorInfoListByTenantId", {
            method: "POST",
            headers: {
              "Authorization": `Bearer ${ieasysellToken}`,

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The memory update stores recent visitor records, counts, inferred behavior, and identifiers for later use, creating a local persistence layer for potentially sensitive customer data. If memory is accessible to other skills, operators, or logs, this expands exposure beyond the original CRM system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The user-facing display name, description, and all listed triggers are presented only in Chinese, while the skill advertises global and multilingual use. This can create a language-policy concern because the skill's invocation surface appears to require Chinese rather than offering a user language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.