ClawHub
Back to skill

Security audit

Huo15 Openclaw Brand Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill’s brand-research purpose is coherent, but it tells users to run under-specified shell commands that can execute mutable third-party code or mishandle unsafe placeholder values.

Review before installing. The skill is not a backdoor, but users should only use it with official public brand sources, should validate brand slugs to simple lowercase letters/numbers/hyphens, quote generated paths, and pin or preinstall Playwright instead of running an unpinned npx command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:63
Finding

Execution of an Unpinned Third-Party Package Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Unpinned dependency execution
Risk Level: High

Vulnerable code:

bash
npx playwright-core screenshot "<URL>" ~/brand-kits/<brand-slug>/raw/home.png --viewport-size=1440,900

Technical Analysis

The skill instructs users to execute playwright-core through npx without specifying a package version, requiring a lockfile, verifying an integrity hash, or enforcing a trusted registry. If the package is not already installed locally, npx may retrieve mutable package content from the configured package registry and execute it with the invoking user's privileges.

Because package resolution occurs when the command is run, the code ultimately executed may differ from the code available when the skill was reviewed. A compromised package release, registry account, transitive dependency, or registry configuration could therefore introduce arbitrary executable behavior. Package lifecycle scripts and the selected CLI entry point may run local commands.

Attack Path

  1. An attacker compromises the relevant package, one of its dependencies, its publishing account, or the package registry path used by the victim.
  2. The user follows the skill's instructions and runs the provided npx playwright-core command.
  3. npx resolves or downloads the mutable, unpinned package content.
  4. Malicious lifecycle or CLI code executes under the user's account.
  5. The payload can access files and resources available to that account, modify local data, or start additional processes.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the command. The accessible scope may include the user's project files, home-directory data, environment variables, authentication material readable by the account, and available network resources. No privilege-escalation mechanism is pr ...[truncated 108 chars]

Remediation
View remediation

Remediation Suggestions

  • Install Playwright as a project dependency using an exact, reviewed version and commit the package lockfile.
  • Invoke only the already-installed package, for example with npx --no-install, so execution fails rather than downloading unexpected code.
  • Use lockfile-integrity enforcement such as npm ci in a controlled project directory.
  • Configure an explicitly trusted registry and verify package provenance before installation.
  • Disable dependency lifecycle scripts during installation where operationally feasible, then explicitly run only required setup steps.
  • Document the expected package version and periodically review dependency advisories and lockfile changes.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:59
Finding

Shell Command Injection Through an Unvalidated and Unquoted Brand Slug

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-63
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable code:

bash
mkdir -p ~/brand-kits/<brand-slug>/raw
curl -fsSL -o ~/brand-kits/<brand-slug>/raw/logo.svg "<URL>"
curl -fsSL -o ~/brand-kits/<brand-slug>/raw/home.html "<URL>"
# When a screenshot is needed:
npx playwright-core screenshot "<URL>" ~/brand-kits/<brand-slug>/raw/home.png --viewport-size=1440,900

Technical Analysis

The skill places the derived <brand-slug> value directly into shell commands without quoting the complete path or defining validation and canonicalization requirements. The brand name is initially supplied by the user, so a generated slug may contain attacker-controlled shell syntax if the agent performs direct or insufficient transformation.

Shell metacharacters, command substitutions, separators, redirections, whitespace, or option-like values in the slug can alter the intended command. Quoting the URL does not mitigate injection through the separate, unquoted path argument. The same unsafe value is reused in directory creation, download destinations, and the screenshot output path.

Attack Path

  1. An attacker supplies a crafted brand name or requests a maliciously formed brand slug containing shell syntax.
  2. The agent substitutes that value into the command template without strict validation.
  3. The generated command is presented to the user as a required download step.
  4. The user copies and executes the command in a shell.
  5. The shell interprets the injected metacharacters or command substitution.
  6. Arbitrary commands execute, or downloads are redirected to attacker-selected local paths.

For example, a slug containing a command separator or command substitution could cause an additional command to run when the generated command is pasted into a shell. Exact payload syntax ...[truncated 628 chars]

Remediation
View remediation

Remediation Suggestions

  • Derive slugs exclusively through deterministic application logic rather than inserting raw user input.
  • Enforce a strict allowlist such as ^[a-z0-9][a-z0-9-]*$ and reject values that do not match.
  • Impose a reasonable maximum slug length.
  • Quote every complete path argument, for example:
    bash
    brand_slug='validated-slug'
output_dir="$HOME/brand-kits/$brand_slug/raw"
mkdir -p -- "$output_dir"
curl -fsSL --output "$output_dir/logo.svg" -- "$url"
curl -fsSL --output "$output_dir/home.html" -- "$url"
  • Use -- where supported to prevent option injection.
  • Validate that the canonical output directory remains beneath the intended "$HOME/brand-kits" root before writing files.
  • Prefer a structured downloader or tool API that passes arguments without shell parsing instead of asking users to execute interpolated shell commands.
  • If commands must be displayed, show validated values separately and warn users not to substitute untrusted text manually.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The metadata description includes broad trigger language like brand research, brand assets, and VI guidelines, which can activate the skill for generic design requests beyond its intended narrow task. Over-broad activation increases the chance the agent applies web-scraping, downloading, and codification behavior in contexts where it should instead ask for clarification or defer, leading to unintended data collection or misuse of adjacent capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Aliases such as '品牌调研', 'brand spec', and 'VI 规范' are generic enough to match many unrelated requests, making accidental invocation likely. In this skill, accidental invocation is more dangerous because the workflow directs the agent to search official sources, suggest download commands, and extract structured branding data, expanding the blast radius of a mistaken activation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx playwright-core without a pinned version, which allows resolution of whatever package version is current at execution time. That creates a supply-chain and reproducibility risk: a compromised, unexpected, or breaking upstream release could be pulled into the workflow and executed on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger section lists ambiguous phrases like '抓品牌' or '复刻这个品牌' without clear boundaries or negative examples, so the skill may engage on requests that imply imitation, broad style copying, or non-public brand analysis. In context, that can steer the agent into collecting and formalizing third-party branding assets when the user's intent or authorization is unclear.

Content

No source excerpt is available for this finding.