ClawHub
Back to skill

Security audit

skill finder

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate ClawHub search CLI, but it installs an unpinned global npm package whose code is not included in the reviewed artifact.

Install only if you trust the npm package publisher and current package contents. Prefer an exact audited version, avoid elevated privileges, and review the npm package source and install scripts before running the global CLI. Treat searches as data sent to ClawHub unless the tool documents otherwise.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:11
Finding

Unpinned Third-Party Package Installed Globally

Content
View full analysis

Vulnerability Details

File Location: skill.md:11-19
Additional Location: readme.md:24-30
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
packages:
  - name: openclaw-skill-finder
    source: npm
    version: ">=1.0.0"
    verified_repo: https://github.com/ZhenRobotics/openclaw-skill-finder
    verified_commit: main
install:
  commands:
    - npm install -g openclaw-skill-finder

The installation is repeated in readme.md:

bash
# Install via npm (recommended)
npm install -g openclaw-skill-finder

# Or via ClawHub
clawhub install skill-finder

Technical Analysis

The dependency accepts any npm release equal to or newer than version 1.0.0. The referenced main branch is mutable and does not cryptographically associate the installed npm artifact with an audited source commit. The project also provides no lockfile, integrity hash, signature, package source, or executable implementation that would allow the installed artifact to be independently verified.

Running npm install -g may execute npm lifecycle scripts and place an executable in a global binary location. Consequently, a compromised npm publisher account, malicious future release, or upstream repository compromise could cause code that was not present during this audit to execute on the user's system.

The submitted project contains documentation only. Therefore, its claims that the external CLI is read-only, safe, and limited to the public ClawHub API cannot be confirmed from the audited files.

Attack Path

  1. An attacker compromises the npm publisher account, upstream release process, or another component of the package supply chain.
  2. The attacker publishes a malicious version satisfying the open-ended >=1.0.0 constraint.
  3. A user follows the documented npm install -g openclaw-skill-finder instruction.
  4. npm resolves the malicious eligi ...[truncated 972 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm dependency to an exact, audited version rather than using >=1.0.0.
  2. Replace verified_commit: main with an immutable full commit SHA corresponding to the published artifact.
  3. Record and verify the package integrity digest and npm provenance before installation.
  4. Include the executable source and a lockfile in the audited project so dependency resolution and runtime behavior can be reviewed.
  5. Prefer a project-local installation over a global installation to reduce the affected scope.
  6. Avoid elevated privileges and disable npm lifecycle scripts where compatible, for example by using --ignore-scripts after confirming that the package does not legitimately require them.
  7. Document the expected domains, network operations, filesystem access, and configuration files used by the CLI.
  8. Re-audit each package update before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · readme.md (reported line 112)May include surrounding context.

Configuration

Create ~/.skill-finder/config.json:

json
{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 232)May include surrounding context.

Configuration

Create ~/.skill-finder/config.json:

json
{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README presents the tool as a search and discovery utility backed by the ClawHub API, but it does not clearly disclose that user queries, browsing requests, and possibly usage metadata will be transmitted to a remote service. This is a privacy/transparency issue rather than code execution, but users may unknowingly send sensitive search terms or internal project interests to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.