Harmonia

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper around the Harmonia ML diagnostics tool, with disclosed package installation and local environment checks that fit its stated purpose.

Install and run this in a project virtual environment rather than a privileged or global Python environment. Review the Harmonia package source/version you are installing, and avoid sharing raw diagnostic output publicly because it may reveal system, GPU, driver, Python, and package details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–21, with related instructions at lines 36–40 and 103–106
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: pip
    kind: uv
    package: harmonia-ml
    bins: [harmonia]
    label: "Install harmonia (pip install harmonia-ml)"

The installation instructions repeat the unpinned package installation:

markdown

### Step 1: Install harmonia (if not already installed)

```bash
pip install harmonia-ml

text

The skill also directs the agent to trust the installed tool and potentially act on its generated recommendations:

```markdown
- If harmonia is not installed, install it with `pip install harmonia-ml` before running commands
- Do NOT try to manually diagnose version compatibility — let harmonia do it
- When harmonia suggests a fix, offer to run the fix command for the user

Technical Analysis

The skill installs harmonia-ml from a package registry without specifying an exact version, cryptographic hash, lockfile, or verified artifact source. Consequently, the code installed and executed can change after this skill has been reviewed.

Package installation and subsequent invocation execute third-party code in the agent's environment. An unpinned dependency allows a compromised maintainer account, malicious future release, or compromised distribution channel to replace the expected implementation. The risk is amplified because the instructions require the agent to defer diagnosis to the package and encourage execution of remediation commands suggested by it.

The reviewed project contains only documentation and skill configuration; it does not include the implementation of harmonia-ml. Therefore, the package's claims of zero dependencies and offline operation cannot be independently verified from this repository. No evidence establishes that the current pa ...[truncated 1849 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin harmonia-ml to a reviewed, exact version in both the OpenClaw installation metadata and shell instructions, for example:

   yaml

   package: harmonia-ml==<reviewed-version>
   

   bash

   python3 -m pip install harmonia-ml==<reviewed-version>
   

2. Install from a lockfile or requirements file containing cryptographic hashes, and enforce hash verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Record and verify the expected package source, artifact digest, publisher identity, and release provenance. Prefer signed artifacts or attestations where available.

4. Review the pinned package implementation and its transitive dependencies before approving it for agent execution.

5. Run diagnostics with least privilege in an isolated virtual environment or container. Do not install or invoke the package using an administrator or root account.

6. Treat commands generated by the diagnostic tool as untrusted output. Display and validate package names, versions, index URLs, shell operators, paths, and side effects before seeking explicit user approval to execute them.

7. Separate diagnosis from remediation: invoking harmonia check should not automatically authorize installation commands or other environment modifications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to install and execute a third-party Python package with pip install harmonia-ml before any clear user confirmation or warning that this changes the environment and trusts code from an external package index. Installing packages via pip can execute untrusted build/install code and permanently modify the user's system or virtual environment, so this creates a real supply-chain and integrity risk even if the package is intended for diagnostics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The diagnostic commands are designed to enumerate detailed host information such as GPU model, VRAM, driver versions, CUDA state, Python environment, and installed ML packages, but the skill does not instruct the agent to obtain consent or warn the user before collecting and displaying that data. While this is operationally useful in context, it can expose sensitive environment metadata that may aid fingerprinting, reveal internal tooling, or leak details if logs are shared broadly.

Content

No source excerpt is available for this finding.