narrated-walkthrough-to-a-numbered-sop-document

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned, but it asks users to use mutable unpinned install commands and moves potentially sensitive Plaud transcript content into Google Docs and Sheets.

Review this skill before installing. Prefer the listed OpenClaw install path or a pinned, verified installer instead of unpinned `npx` commands, and only run it on Plaud recordings that are approved for export into Google Docs and Sheets. Consider reviewing or redacting transcripts first when recordings may contain confidential operations, safety procedures, customer data, or regulated information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–37
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

Equivalent unpinned installation commands are also present at lines 27, 31, 56, 65, 74, 85, 92, and 97–100.

Technical Analysis

The skill directs users to run the skills npm CLI through npx without specifying an exact package version, lockfile, or integrity hash. If the package is not already available locally, npx can retrieve the current package release from the configured npm registry and execute its CLI code.

Because dependency resolution is mutable, the code ultimately executed may differ from the code that existed when this skill was reviewed. A compromised package release, publisher account, registry, or upstream dependency could therefore introduce malicious behavior. The referenced AgentPMT skill content is also installed dynamically rather than bundled with an auditable revision or verified checksum.

This is classified as a supply-chain weakness rather than confirmed malicious behavior. The audited file contains no embedded payload, obfuscation, or direct evidence that the current upstream packages are malicious.

Attack Path

1. An attacker compromises the relevant npm publisher, package release process, registry response, or transitive dependency.
2. The attacker publishes or serves a modified version of the unpinned skills package or associated installable content.
3. A user follows the setup instructions and executes npx skills add ....
4. npx resolves and downloads the mutable package version from the configured registry.
5. The downloaded CLI code executes with the operating-system privileges of the invoking user.
6. Malicious code could access data availa ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI to an explicitly reviewed version, for example by using npx skills@<approved-version> rather than an unversioned package reference.
2. Record and verify the package integrity hash through a lockfile or equivalent reproducible dependency manifest.
3. Pin the AgentPMT skill repository to an immutable commit identifier or signed release rather than a mutable branch or latest release.
4. Verify downloaded artifacts against published checksums or cryptographic signatures before execution.
5. Use an organization-controlled package registry or allowlist that contains only reviewed package versions.
6. Prefer a locally installed, audited CLI invoked with options that prevent automatic remote package resolution.
7. Disable dependency lifecycle scripts where compatible with the installer, and review the CLI package and its transitive dependencies before approval.
8. Run installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and limited network permissions.
9. Update every repeated npx skills add example in SKILL.md so users are not directed toward an insecure fallback command.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow directs the agent to retrieve Plaud transcripts and write derived operational procedures to Google Docs and Google Sheets, but it does not clearly warn the user that sensitive spoken content may be transmitted to and stored in multiple third-party services. These recordings may contain proprietary processes, facility details, safety procedures, or regulated information, so the lack of explicit consent/data-handling notice can cause confidentiality and compliance issues.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx skills add ... without pinning a specific package version. npx resolves and executes whatever version is current at install time, which creates a supply-chain risk: a compromised upstream package, malicious update, or breaking change could cause unreviewed code to run or alter installed skill behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This installation command uses unpinned npx, so the executed package version is not fixed. That exposes users to package substitution, compromised updates, or unexpected behavior changes that can lead to execution of attacker-controlled code during install or setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill includes another unpinned npx skills install command, again leaving the package version and fetched code uncontrolled. In a skill distribution context, repeated unpinned install instructions increase exposure to supply-chain compromise across dependencies and setup steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command relies on npx without version pinning, which means future installs may execute a different package than the one originally reviewed. That weakens reproducibility and allows malicious or vulnerable upstream releases to affect users immediately.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command at this line invokes an unpinned package through npx, creating a standard remote package execution risk. If the package or one of its resolution paths is hijacked, the user may run malicious code simply by following the skill setup instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This setup instruction uses unversioned npx skills, so the command is not reproducible and may fetch newly published code without review. That is a real supply-chain exposure, especially because skills are meant to be followed as trusted operational guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Another unpinned npx invocation appears here, carrying the same risk of executing unintended package versions at install time. Because the skill aggregates multiple external tool dependencies, any one compromised install path can undermine the whole workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The instruction at this line references npx skills without a pinned version, exposing users to upstream tampering or accidental breaking updates. This is dangerous because it turns documentation into a vehicle for executing code from a mutable external source.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This is another true positive for unpinned npx package execution. Anyone following the workflow may unknowingly install and execute code different from what the skill author reviewed, enabling supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command here again uses unpinned npx, which is a real vulnerability pattern in setup documentation because it delegates trust to the current state of the package registry. That can result in malicious code execution or silent behavior drift.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This line repeats the same unpinned package execution pattern. Repetition matters operationally because users may copy any one of these commands, so every occurrence should be treated as an independently exploitable supply-chain weakness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The npx skills reference is unversioned and therefore non-deterministic. In the context of agent/tool installation, this creates a realistic path for registry compromise or malicious update abuse to affect downstream users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This unpinned npx command is a true supply-chain risk because it may execute whatever version is latest at runtime. For setup guidance embedded in a skill, that means users are asked to trust changing external code without any integrity guarantees.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command at this line also leaves the executed package unpinned. That makes the installation path mutable and vulnerable to both malicious package publication and benign but unsafe upstream changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This final unpinned npx reference has the same supply-chain exposure as the others. The skill context makes it more concerning because the document encourages repeated use of external tools and connectors, so trust in installation integrity is especially important.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.