ClawHub
Back to skill

Security audit

sleep-health-assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a local sleep and stress wellness skill with no observed network or file access, though users should note the unpinned install examples and temporary in-memory handling of health inputs.

Install only from a trusted ClawHub source, prefer a pinned version or verified package if available, and treat this as general wellness guidance rather than medical advice. Use the cleanup command after entering sensitive health details, especially in shared or long-running OpenClaw sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Note
Location
README.md:39
Finding

Unpinned ClawHub Package Installation Enables Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 39-43; duplicated in SKILL.md, lines 123-129
Vulnerability Type: Unpinned third-party package installation
Risk Level: Low

Vulnerable Code

bash
# Install from ClawHub
npx clawhub install sleep-health-assistant

The documented installation command identifies the package only by name. It does not pin a package version, release digest, commit, or integrity hash. Consequently, the code installed by a user can differ from the version represented by the audited project files.

npx may also retrieve and run the clawhub command from the configured npm registry when it is not already installed locally. This adds another mutable dependency to the installation path.

Technical Analysis

The effective installation chain depends on the current registry entries for both clawhub and sleep-health-assistant. If either registry account, package, release process, or configured registry is compromised, a malicious release could be served after this audit without modifying the reviewed repository.

The reviewed Python implementation itself contains no remote download or execution logic. The risk is limited to the documented installation process and therefore requires a user or administrator to execute the command.

Attack Path

  1. An attacker compromises a relevant registry publisher account, release pipeline, registry mirror, or package namespace.
  2. The attacker publishes a malicious version under clawhub or sleep-health-assistant.
  3. A user follows the documented unpinned installation command.
  4. The package manager resolves the mutable package name to the attacker-controlled release.
  5. The malicious package executes with the permissions available to the installing user or is loaded by OpenClaw as an installed skill.

Impact Assessment

Successful exploitation could allow attacker-controlled package code to execute with the privi ...[truncated 413 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the clawhub CLI to a reviewed version rather than allowing npx to resolve an arbitrary current release.
  • Pin the skill to an immutable version, release digest, or verified commit.
  • Publish and verify cryptographic checksums or package signatures before installation.
  • Prefer a lockfile-backed installation workflow with integrity metadata.
  • Document the expected package publisher and trusted registry.
  • Avoid automatically accepting newly published versions; require review before updating.
  • Apply the same changes to the duplicated installation instructions in SKILL.md and the packaged sleep-health-assistant-v1.0.0/ directory.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.py:317
Finding

Unbounded Retention of User-Controlled Health Data Can Exhaust Process Memory

Content
View full analysis

Vulnerability Details

File Location: skill.py, lines 317-324; duplicated in sleep-health-assistant-v1.0.0/skill.py, lines 317-324
Vulnerability Type: Unbounded in-memory storage of attacker-controlled data
Risk Level: Medium

Vulnerable Code

python
# Store in memory only (no disk persistence)
session_id = f"session_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
self.session_data[session_id] = {
    "data": user_data,
    "timestamp": datetime.now().isoformat(),
    "recommendations": []
}

Every distinct session identifier adds user-controlled user_data to self.session_data. The implementation has no maximum session count, per-entry size limit, total-memory limit, expiration policy, or automatic cleanup. Data is retained until the explicit cleanup command is invoked or the process terminates.

Session identifiers have one-second resolution. Calls made during the same second overwrite one another, but calls distributed across different seconds continue growing the dictionary without a bound. A caller can also submit an unusually large nested data structure in a single request, subject to limits imposed by the surrounding framework.

Technical Analysis

In-memory processing prevents disk persistence but does not by itself provide safe resource management. Retaining references to arbitrary caller-supplied objects prevents those objects from being garbage-collected. An attacker who can repeatedly invoke health-monitoring can therefore cause sustained heap growth.

This behavior conflicts with the configuration claim that resource management is efficient and with the documented memory target of less than 50 MB. No enforcement mechanism implements those limits.

Attack Path

  1. An attacker obtains permission to invoke the exposed health-monitoring command.
  2. The attacker submits health-monitoring requests containing large or numerous distinct user_data values.
  3. Requests are ...[truncated 784 chars]
Remediation
View remediation

Remediation Suggestions

  • Enforce a strict maximum serialized size for user_data before retaining it.
  • Limit the number of retained sessions with a bounded structure such as an LRU cache or fixed-length deque.
  • Add short session expiration times and perform automatic removal of expired entries.
  • Store only the minimal normalized fields required for recommendations rather than retaining the complete caller-supplied object.
  • Apply per-user and global rate limits to health-monitoring.
  • Isolate session state by authenticated user or invocation context.
  • Generate collision-resistant session identifiers, while retaining explicit capacity limits.
  • Ensure cleanup runs automatically when a session closes and in exception paths.
  • Add tests that submit oversized inputs and repeated requests and verify that memory use remains bounded.
  • Apply the correction to both copies of skill.py to prevent the packaged version from retaining the flaw.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skill.py (reported line 259)May include surrounding context.

python
"steps": [
                    "Sit comfortably",
                    "Focus on present moment",
                    "Notice thoughts without judgment",
                    "Return to awareness when distracted",
                    "Practice for 10-15 minutes"
                ],

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · sleep-health-assistant-v1.0.0/skill.py (reported line 259)May include surrounding context.

python
"steps": [
                    "Sit comfortably",
                    "Focus on present moment",
                    "Notice thoughts without judgment",
                    "Return to awareness when distracted",
                    "Practice for 10-15 minutes"
                ],

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The changelog explicitly states exclusion of culture-specific or traditional methods, which can encode unjustified bias in how the skill presents wellness guidance. In a health-related assistant, this creates a product-level safety and fairness issue because users may be denied relevant, user-preferred, or culturally appropriate options without informed consent or transparent rationale.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to execute npx clawhub install sleep-health-assistant without pinning a specific package version. This can cause users to fetch and run whatever package version is current at execution time, increasing supply-chain risk if the registry package is updated maliciously, compromised, or unexpectedly changed. The surrounding claims of security do not mitigate this risk because the install path itself is unpinned.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The troubleshooting command npx clawhub list | grep sleep-health again relies on an unpinned npx clawhub invocation, which may download and execute the latest available package version. Even though this is presented as a harmless diagnostic step in a wellness skill, it still creates a supply-chain execution path where compromised upstream content could run on the user's system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation states the skill requires 'Cultural neutrality' and excludes 'culture-specific or traditional methods' and 'religious content.' This is a natural-language policy concern because it imposes a content/locale-style constraint on users without presenting it as an optional preference or a clearly justified compliance requirement.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation command uses npx clawhub install sleep-health-assistant without pinning an exact package version. This can cause users to fetch whatever version is current at install time, increasing supply-chain risk if a malicious or compromised release is published later. The file context slightly increases risk because the document repeatedly emphasizes safety and local-only behavior, which may encourage users to trust and install the package without additional verification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The changelog states a content policy of 'Cultural neutrality,' 'No culture-specific or traditional methods,' and exclusion of religious practices and terminology. This is a natural-language policy constraint that enforces a particular cultural/locale framing rather than offering user choice or documenting a necessary region-specific justification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx clawhub install sleep-health-assistant without pinning a specific package version. This can cause users to fetch and execute whatever package version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or replaced. The surrounding security claims in the README do not mitigate this risk because the unsafe action occurs before the skill is inspected or installed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The troubleshooting command npx clawhub list | grep sleep-health also invokes npx clawhub without a pinned version, which may download and execute an unexpected release of the tool. Even though this appears to be a harmless diagnostic example, it still normalizes unpinned execution of remote tooling and exposes users to avoidable supply-chain compromise risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The policy statement says the skill provides 'Cultural neutrality' by excluding culture-specific methods, which is a natural-language constraint on allowed content rather than a user choice. This can unfairly restrict user-preferred culturally grounded wellness practices without documenting a justified scope limitation or offering opt-in alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The statement 'No religious content' is a blanket natural-language policy that forces one content constraint for all users. Under the policy criteria, this is a restrictive language/content rule without user opt-in and no region- or compliance-based justification is provided in the file.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scope note says the skill 'Excludes religious and culture-specific content,' which imposes a blanket content/locale-style restriction across all users. The file does not offer a user choice or explain a necessary compliance reason for this exclusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

Describing the skill as 'scientific' and 'evidence-based' without qualification can mislead users into assigning more medical authority or reliability than is warranted, especially in a health context. This increases the chance users rely on simplified guidance as if it were professional or clinically validated advice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill stores health-related session data in memory, and while it later mentions privacy/data handling in responses, there is no clear user-facing disclosure or consent at the point data is collected and retained. For health-related information, even transient retention can create privacy risk if users are unaware their data is being stored for the session.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest file applies to the vague-trigger category, and the description 'Scientific sleep and stress analysis assistant' describes capability but gives no specific invocation phrases, scope limits, or exclusion conditions. Without explicit trigger wording or negative examples, the skill could be matched to broad everyday requests about sleep or stress.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.