Chart MPL

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:27 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward CSV-to-chart helper, with the main caveat that it asks users to install an unpinned Python plotting dependency in a reusable virtual environment.

Install only from a trusted Python package index, consider pinning matplotlib and dependencies if reproducibility matters, and run the script only on CSV files and output paths you intend to use. Review generated image paths before sharing them if the source data is sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash

python3 -m venv ~/.openclaw/workspace/.venv_chart
~/.openclaw/workspace/.venv_chart/bin/pip install matplotlib

Technical Analysis

The documented setup installs matplotlib without specifying a reviewed version or validating package hashes. Consequently, installations are not reproducible: pip may resolve different versions of matplotlib and its transitive dependencies over time.

If a future package release or a package supplied by the configured Python package index is compromised, malicious installation or import-time code could execute under the account following these instructions. The risk depends on the integrity of the configured package repository and the packages it serves; the audit found no evidence that the project itself intentionally distributes a malicious dependency.

Attack Path

1. An attacker compromises a future release of matplotlib, one of its transitive dependencies, or a package index configured in the environment.
2. A user follows the setup instructions and runs the unpinned pip install matplotlib command.
3. Pip resolves and downloads the attacker-controlled package version.
4. Malicious package code executes during installation or when scripts/chart_mpl.py imports the dependency.
5. The code operates with the privileges of the user running pip or the chart script.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. This could expose files and credentials accessible to that account, alter workspace content, or affect generated output. The code is installed in a virtual environment, but a virtual environment does not provide an operating-system security boundary or restrict access to user resources.

Remediation

View remediation

Remediation Suggestions

1. Pin matplotlib and every transitive dependency to reviewed, exact versions in a lock file.
2. Record cryptographic hashes and install with hash verification, for example:

bash

python3 -m pip install --require-hashes -r requirements.txt

3. Generate and review the lock file through a controlled dependency-update process.
4. Document and enforce a trusted package index rather than relying on unspecified local pip configuration.
5. Run dependency vulnerability and provenance checks before approving updates.
6. Avoid performing package installation with elevated privileges.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description says to use the skill when the user asks to 'visualize tabular data,' 'produce BI-ready chart images,' or 'compare multiple series,' which are broad natural-language conditions rather than a specific invocation scope. The file does not provide exclusion conditions or negative examples to clarify when this skill should not be selected versus other data-analysis or charting skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs creation of a persistent virtual environment under a fixed workspace path and performs a one-time package installation that survives across sessions. Persistent environments can accumulate unreviewed state, stale or tampered dependencies, and cross-task contamination, which increases the risk of supply-chain compromise or unexpected behavior in later runs.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Setup

Create a virtual environment and install matplotlib (one-time):

bash

python3 -m venv ~/.openclaw/workspace/.venv_chart

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI defaults --numfmt to fr, which imposes a specific locale-style numeric rendering unless the user explicitly overrides it. Under the policy, forcing a language or locale preference without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.