ClawHub
Back to skill

Security audit

Decentralized Agent Cloud

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to install an unpinned npm package and route prompts, scripts, and datasets through a decentralized provider marketplace without enough privacy or trust-boundary detail.

Review this carefully before installing. Use a pinned package version or lockfile, install in a least-privileged environment, and do not submit secrets, private datasets, regulated data, or sensitive prompts unless you have verified the provider, data handling, retention, and compliance protections yourself.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding
Unpinned Executable npm Dependency Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-22` and `SKILL.md:68-81` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml requires: tools: - node>=18 - npm packages: - name: openclaw-decentralized-agent-cloud source: npm version: ">=0.1.0" verified_repo: https://github.com/openclaw/openclaw-decentralized-agent-cloud ``` The installation instructions also resolve the package without specifying an exact version: ```bash # Via npm npm install openclaw-decentralized-agent-cloud # Via ClawHub clawhub install decentralized-agent-cloud ``` ### Technical Analysis The dependency constraint `>=0.1.0` accepts every subsequent compatible or incompatible release selected by the package resolver. The direct npm command similarly installs the registry's current default release rather than a previously audited artifact. An npm package can contain executable runtime code and npm lifecycle scripts. Consequently, package installation may execute code with the permissions of the user running npm. The `verified_repo` value identifies an expected source repository but does not cryptographically bind the installed registry artifact to a reviewed commit, exact version, or integrity digest. The audited project contains only `SKILL.md`; it does not include the dependency implementation, a lockfile, or an integrity hash. The actual behavior of the package and its installation scripts therefore could not be verified from this artifact. This finding establishes an unsafe dependency-resolution practice, not evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, build pipeline, source repository, or another component involved in publishing `openclaw-decentralized-agent-cloud`. 2. The attacker publishes a new package release satisfying `>=0.1.0` or changes the release selected by the unver ...[truncated 1151 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the open-ended dependency range with an exact, reviewed version, for example: ```yaml version: "0.1.0" ``` 2. Update the npm installation example to request that exact version: ```bash npm install --save-exact openclaw-decentralized-agent-cloud@0.1.0 ``` 3. Commit and enforce a lockfile containing registry integrity metadata. Use deterministic installation commands such as `npm ci` in automated environments. 4. Verify the package tarball's integrity and provenance against an approved digest and trusted release process rather than relying only on the repository URL. 5. Review dependency lifecycle scripts before approval. Where functionality permits, install with `--ignore-scripts` and explicitly run only required, reviewed setup steps. 6. Perform dependency updates through a controlled review process that checks source changes, published tarball contents, maintainers, provenance attestations, and transitive dependencies. 7. Install and run the package in a least-privileged, isolated environment without unnecessary secrets, host filesystem access, or privileged container permissions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill presents a decentralized marketplace that executes tasks on external providers, including examples that send prompts, scripts, and dataset locations to third-party compute. However, it does not clearly warn users that their prompts, datasets, and possibly outputs may be transmitted to external providers or services, which can lead to inadvertent disclosure of sensitive or regulated data. In this context, the omission is more dangerous because the skill is explicitly designed to route work across decentralized infrastructure where trust boundaries are broader and less predictable than a single hosted service.

Static analysis

No suspicious patterns detected.