ClawHub
Back to skill

Security audit

Task Watchdog

Security checks for vulnerabilities and agentic risk

Overview

The plugin’s stated purpose is coherent, but the submitted artifact does not include the executable code it tells OpenClaw to load, despite automatic startup and session-injection capabilities.

Review this package before installing from a registry. It starts automatically, watches subagent and exec lifecycle events, can trigger heartbeat checks, and can inject notifications into parent sessions. Only install a pinned, audited release that includes the actual dist/index.mjs or matching source/provenance, and disable timer patrol if recurring background checks are not wanted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:32
Finding

Unpinned External Package Installation Exposes Users to Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md:32-38, SKILL.md:14-16, and package.json:6-13
Vulnerability Type: Unpinned and unverifiable third-party runtime package
Risk Level: Medium

The installation documentation instructs users to install openclaw-task-watchdog without specifying an exact version or integrity value:

bash
# Via OpenClaw plugin install
openclaw plugin install openclaw-task-watchdog

# Via npm
npm install openclaw-task-watchdog

The abbreviated skill documentation contains the same unpinned installation instruction:

bash
openclaw plugin install openclaw-task-watchdog

The package manifest identifies a compiled runtime entry point:

json
"exports": {
  ".": {
    "import": "./dist/index.mjs"
  }
},
"main": "./dist/index.mjs",
"types": "./dist/index.d.mts",
"files": [
  "dist/",
  "openclaw.plugin.json"
],

However, the reviewed project contains neither the referenced dist/index.mjs artifact nor the configured src/ source tree. The executable plugin implementation therefore could not be inspected or compared with the documented behavior.

Technical Analysis

Installing a package without an explicit version generally resolves the registry's current distribution tag. The effective code installed by a user may consequently differ from the package version or documentation that was reviewed. No package-lock file, integrity hash, signed artifact, or reproducible-build verification data is included to bind installation to a particular runtime artifact.

This concern is amplified because the manifest activates the plugin at startup and the documentation states that it observes subagent and tool events, requests heartbeat activity, and injects messages into parent sessions. Those capabilities place the unavailable runtime implementation in a sensitive execution context.

The finding does not establish that the currently published npm p ...[truncated 1709 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete src/ implementation and the generated dist/index.mjs artifact in the repository or audit submission.
  2. Pin installation documentation to an exact reviewed package version rather than relying on a mutable current distribution tag.
  3. Publish and verify package integrity hashes or signed provenance attestations for release artifacts.
  4. Add a lockfile where applicable and use deterministic, reproducible builds.
  5. Ensure CI builds dist/index.mjs exclusively from the reviewed source and compares the resulting artifact with the published npm package.
  6. Protect publisher accounts with phishing-resistant multi-factor authentication and restrict release permissions.
  7. Document the plugin permissions and minimize its access to files, network resources, session data, and privileged OpenClaw APIs.
  8. Require security review whenever the pinned package version or compiled runtime artifact changes.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Known Vulnerable Dependency: openclaw==2026.5.7 — 16 advisory(ies): CVE-2026-53812 (OpenClaw's browser act interactions could bypass private-network navigation chec); CVE-2026-53816 (OpenClaw: Paired nodes could forge exec lifecycle events without system.run prov); CVE-2026-53814 (OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The manifest includes openclaw 2026.5.7 as a devDependency, and the static analysis indicates that exact version has multiple known advisories, including issues affecting event forgery and authority handling. Even as a development dependency, a vulnerable framework version can compromise local testing, packaging, or release workflows and may mask or introduce unsafe behavior during plugin development.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description says the plugin will 'notify parent agent on subagent failure / exec abnormal exit via next-turn injection,' but it does not clearly define the exact activation conditions, scope boundaries, or exclusions, which could make invocation behavior unclear.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: openclaw has 16 known advisory(ies) (CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
}
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "openclaw": "2026.5.7"
  }
}

Static analysis

No suspicious patterns detected.