ClawHub
Back to skill

Security audit

Decentralized Agent Cloud

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to install an unpinned npm package and route prompts, scripts, and datasets through a decentralized provider marketplace without enough privacy or trust-boundary detail.

Review this carefully before installing. Use a pinned package version or lockfile, install in a least-privileged environment, and do not submit secrets, private datasets, regulated data, or sensitive prompts unless you have verified the provider, data handling, retention, and compliance protections yourself.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Executable npm Dependency Creates a Supply-Chain Risk

Content
View full analysis
=18 - npm packages: - name: openclaw-decentralized-agent-cloud source: npm version: ">=0.1.0" verified_repo: https://github.com/openclaw/openclaw-decentralized-agent-cloud ``` The installation instructions also resolve the package without specifying an exact version: ```bash # Via npm npm install openclaw-decentralized-agent-cloud # Via ClawHub clawhub install decentralized-agent-cloud ``` ### Technical Analysis The dependency constraint `>=0.1.0` accepts every subsequent compatible or incompatible release selected by the package resolver. The direct npm command similarly installs the registry's current default release rather than a previously audited artifact. An npm package can contain executable runtime code and npm lifecycle scripts. Consequently, package installation may execute code with the permissions of the user running npm. The `verified_repo` value identifies an expected source repository but does not cryptographically bind the installed registry artifact to a reviewed commit, exact version, or integrity digest. The audited project contains only `SKILL.md`; it does not include the dependency implementation, a lockfile, or an integrity hash. The actual behavior of the package and its installation scripts therefore could not be verified from this artifact. This finding establishes an unsafe dependency-resolution practice, not evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, build pipeline, source repository, or another component involved in publishing `openclaw-decentralized-agent-cloud`. 2. The attacker publishes a new package release satisfying `>=0.1.0` or changes the release selected by the unver ...[truncated 1151 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill presents a decentralized marketplace that executes tasks on external providers, including examples that send prompts, scripts, and dataset locations to third-party compute. However, it does not clearly warn users that their prompts, datasets, and possibly outputs may be transmitted to external providers or services, which can lead to inadvertent disclosure of sensitive or regulated data. In this context, the omission is more dangerous because the skill is explicitly designed to route work across decentralized infrastructure where trust boundaries are broader and less predictable than a single hosted service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.