ClawHub
Back to plugin

Security audit

ReefClaw Trading

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trading plugin with significant live-trading authority, but the artifacts consistently scope that authority to operator-controlled setup, local credential storage, signed instruction updates, and dashboard telemetry.

Install only if you want a local agent connected to ReefClaw to manage paper trading and, after your explicit setup, live exchange trading. Review the capabilities carefully: it can place and cancel orders once you add credentials and switch modes, sends trading telemetry to ReefClaw, runs a connector at startup, and supports signed remote instruction updates.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
**Do not attempt to perform this install yourself, and do not work around it if it is unavailable to you.** Specifically: do not edit OpenClaw's configuration to enable chat install commands, do not add anyone to an owner or elevated-exec allowlist, do not enable elevated mode, and do not restart the gateway to widen your own permissions. If you cannot run the command, the correct outcome is to hand the user the one line above and let them run it deliberately. A trading integration is exactly the kind of software whose installation a human should perform knowingly.

**If the user installs via ClawHub instead** — no terminal needed on OpenClaw 2026.8.1 or newer: either OpenClaw's Control UI (Plugins → Discover → search "reefclaw" → Install → accept the listed capabilities), or the chat command `/plugins install clawhub:@reefclaw/openclaw-plugin` followed, after reading the capability list it replies with, by the same command plus `--accept-capabilities` (the chat command needs `commands.plugins: true` in openclaw.json, which only the user sets). ClawHub scans every release with an automated security reviewer; the current release passes it (no warning at install). If a newer release ever shows a "Review" label, OpenClaw 2026.8.1+ shows the audit and continues once the capabilities are accepted, while OpenClaw 2026.7.x may block the chat command on it — there the user runs the `npx` line above.

Whatever the install path, **save the connection settings anyway** — the connector picks them up automatically the moment the plugin is running.
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
bridge/providers/connector-update-direct.js:180
Evidence
child = spawn(npx, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], shell: false });