Product Analysis Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.2.1

Overview

The skill mostly performs simple product analysis, but an included batch script can load code from outside the skill folder, so it needs review before installation.

Install only if you are comfortable with a review-required package. The main script is low impact, but avoid running the batch analyzer unless the `subagent` dependency resolution is fixed or the surrounding install directory is trusted and not writable by untrusted users.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: batch_product_analyzer.py:14

Finding

Unsafe Python Import Path Enables Dependency Hijacking

Content

View full analysis

Vulnerability Details

File Location: batch_product_analyzer.py, lines 14–16
Vulnerability Type: Unsafe dependency resolution and Python module hijacking
Risk Level: High

python

# Import SubAgent system
sys.path.insert(0, str(Path(__file__).parent.parent.parent))
from subagent import SubAgentManager, AgentStatus

Technical Analysis

The batch analyzer prepends a broad ancestor directory to sys.path before importing the external subagent module. Because index zero has the highest import precedence, Python will load a module named subagent from that ancestor location before considering normally installed or framework-provided packages.

The imported dependency is not included in the audited project and is not pinned to a specific package version or validated source. Python executes module-level code immediately upon import. Consequently, any party able to place a malicious subagent.py file or subagent package in the searched ancestor directory can execute arbitrary Python code when batch_product_analyzer.py starts.

This is a dependency-hijacking condition caused by unsafe import-path manipulation. Exploitation requires write access to the selected ancestor directory or another mechanism capable of introducing a module there.

Attack Path

1. An attacker identifies the directory inserted into sys.path, resolved from Path(__file__).parent.parent.parent.
2. The attacker obtains write access to that directory, such as through a shared workspace, compromised extraction process, insecure deployment permissions, or another component writing files there.
3. The attacker creates a malicious subagent.py file or subagent/__init__.py package in that directory.
4. A user or OpenClaw process launches batch_product_analyzer.py.
5. Python searches the attacker-controlled ancestor directory first and imports the forged module.
6. Module-level malicious code executes immediately with the privileges and environment of the proc ...[truncated 775 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the ancestor-directory modification:

   python

   sys.path.insert(0, str(Path(__file__).parent.parent.parent))
   

2. Import subagent through the OpenClaw framework's supported package or plugin mechanism rather than dynamically expanding Python's search path.

3. Declare the dependency explicitly and pin it to an approved version and integrity hash where the deployment system supports hash verification.

4. Package the project as a proper Python module and use explicit package imports. Avoid relying on ambient files outside the project or installed dependency environment.

5. If framework constraints make custom resolution unavoidable:

   • Resolve the expected module to a fixed, trusted directory.
   • Verify that the resolved path remains within that directory.
   • Reject symlinks and unexpected ownership or writable permissions.
   • Validate the dependency's cryptographic hash or signature before loading it.
   • Avoid adding the location globally to sys.path.

6. Run the Skill with a least-privileged service account and ensure application, framework, and ancestor directories are not writable by untrusted users or unrelated processes.

7. Add an automated test that inspects subagent.__file__ and fails when the dependency resolves outside the approved OpenClaw installation path.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation phrase "product analysis" is generic enough to match ordinary user requests that are merely descriptive rather than intended as an explicit tool invocation. In an agentic environment, this can cause unintended skill activation, sending user data or control flow into this skill without clear user intent, which increases prompt-injection and mis-execution risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The phrase "market analysis" is especially broad and likely to appear in normal business conversations, making accidental activation more likely. Because the README describes automatic activation words but no disambiguation or consent mechanism, the skill could intercept unrelated requests and influence agent behavior unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 69% confidence

Finding

The documentation hard-codes supported activation words in Chinese and English but does not state whether language selection is user-configurable or limited by policy. This can create a language/locale constraint without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script prints a hard-coded banner beginning with "LAOSI," indicating a specific language/locale framing without any user opt-in or alternative locale selection. This matches the policy category for language or locale constraints expressed in natural-language output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The documentation around analyze_product says the implementation is a simplified mock analysis, but the overall file also includes command-line behavior that reads product lists from arbitrary files and writes results to arbitrary output files. That does not make the code unsafe by itself, but the surrounding documentation understates the module's actual side effects and usage surface.

Content

No source excerpt is available for this finding.