Workflow Cache

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:09 AM UTC
• Version: 1.0.4

Overview

This skill is mostly coherent as a cloud workflow cache, but it automatically sends intent and session-derived workflow data to a cloud service and can execute cloud-returned workflows with broad browser/session access.

Review before installing. Use this only if you are comfortable with a cloud service receiving your automation intents, URLs, DOM skeleton hashes, node/session identifiers, and compiled workflow patterns. Disable auto_contribute unless you explicitly want to share successful workflows, restrict use on sensitive sites, and prefer a pinned install version plus a clearly trusted endpoint.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill.json:11

Finding

Automatic Contribution of Session-Derived Data with Excessive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Remote Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.json:20

Finding

Unrestricted and Inconsistently Documented Cloud Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes a caching component for cloud workflow reuse and token reduction. The supplied code instead defines an intent-parsing interface and function that interpret natural language plus URL context into structured fields. This is a materially different primary purpose and capability set: parsing/normalization versus workflow caching. There is no indication in the code of cache management, cloud storage, workflow reuse, or token-usage reduction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is a cloud workflow cache used to reduce token usage by reusing verified automation patterns. The supplied code does not implement caching, cloud storage, workflow retrieval, token reduction, or pattern reuse. Instead, it performs lightweight local NLP-style parsing: it normalizes text, detects an action verb, extracts an object phrase, and parses a domain from a URL. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is a cloud workflow cache focused on reusing verified automation patterns to reduce token usage. The supplied code instead defines a sanitizer whose stated role is to remove PII from traces and action arguments before transmission. That is a materially different primary purpose and introduces undeclared privacy/sanitization capabilities. There is no indication in this code chunk of caching, workflow reuse, or token optimization, so the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is a cloud workflow cache focused on reuse of automation patterns to reduce token usage. The supplied code does not implement caching, cloud workflow storage, token optimization, or pattern reuse. Instead, it provides a local privacy/sanitization layer that detects and replaces sensitive data in traces and arguments. This is a materially different primary purpose and introduces undeclared privacy-sanitization capabilities unrelated to the declared cache behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description emphasizes a cloud cache that reuses verified automation patterns to reduce token usage. The supplied code instead exposes a compileTrace function whose primary purpose is to convert recorded OpenClaw session traces into reusable Lobster workflows. That is a materially different behavior: workflow compilation/generation from traces rather than caching or retrieving existing workflows. No cloud cache behavior is evident in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents this as a 'cloud workflow cache' focused on reuse for token savings, but the code shown does not implement caching, cloud storage, retrieval, or token-usage management. Instead, its primary function is a trace compiler: it transforms successful recorded browser actions into a portable workflow object. That is a materially different purpose from a cache. While both relate to reusing automation patterns, the implemented behavior is specifically offline compilation/translation and optimization of traces, not cache management.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.4 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins undici to version 7.24.4, and the supplied finding indicates this exact version is affected by multiple known HIGH-severity advisories, including issues involving HTTP response queue poisoning, response desynchronization, and cross-user information disclosure. Because this skill is a cloud workflow cache component and undici is an HTTP client library, vulnerable request/connection handling could plausibly be exercised in normal operation and may expose cached data, corrupt request/response boundaries, or enable denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.4 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package resolves to a specifically identified vulnerable version of undici with multiple advisories, including response queue poisoning, information disclosure, and response desynchronization issues. Because this skill appears cloud- and workflow-cache-oriented, a vulnerable HTTP client is especially dangerous: it may handle agent-to-service traffic, increasing the risk of cross-request data leakage, cache poisoning, or malformed-response abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises cloud querying and contribution of session-derived workflows but does not clearly disclose that user/session data may be transmitted off-host or explain the privacy implications. Because the skill is explicitly designed to intercept intents and upload successful sessions, users may unknowingly expose prompts, traces, credentials, or other sensitive operational context unless strong sanitization and consent mechanisms exist and are documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that it queries a cloud endpoint and may auto-contribute successful workflows, but the user-facing description does not provide a clear warning that workflow-derived data is sent off-device during normal operation. This can mislead users about data exposure and consent, especially because interception occurs before normal LLM processing and auto_contribute defaults to true.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation command uses npx clawhub without pinning an exact package version, which can cause users to fetch and execute an unexpected or newly compromised release at install time. In a security-sensitive agent ecosystem, this increases supply-chain risk because installation itself may run attacker-controlled code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The interceptor is described as 'the main hook that fires on every intent,' and on a cloud hit it may execute a cached workflow directly while skipping normal LLM exploration. That broad activation surface increases the chance that ordinary or sensitive user requests are intercepted unexpectedly, routed to remote matching logic, or executed through an unintended automation path, which can bypass user expectations and weaken safety boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The comments explicitly describe sending user intents to 'ClawMind Cloud' for matching and contributing successful session traces back to the cloud. Because intents and traces can contain sensitive prompts, credentials, internal URLs, or workflow data, this creates a real data exfiltration and privacy risk if users are not clearly informed and protected by consent, minimization, and redaction controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The interceptor sends intent, current URL, DOM skeleton hash, and node ID to a remote cloud service during matching, but this file shows no explicit user-facing notice, consent, or visibility into that telemetry. In an automation context, those fields can reveal browsing targets, internal application structure, and user objectives, increasing privacy and operational exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code automatically uploads successful session traces as compiled workflows to a cloud service, which goes beyond passive local caching and creates a data exfiltration path. Because traces, intent, URL, and workflow steps can encode sensitive user activity or site-specific automation details, this behavior is risky unless users explicitly consent and the exported content is minimized and sanitized.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description emphasizes workflow caching, but this code also sends session-derived workflows and metadata back to the cloud automatically. That mismatch is dangerous because users may reasonably expect retrieval-only behavior, while the implementation performs outbound sharing of operational traces that may contain private or proprietary information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest enables automatic contribution of workflows while also requesting network and session-history related capabilities, but it provides no user-facing disclosure or consent mechanism for cloud transmission of session-derived data. In this skill context, a cloud cache that reuses workflows is specifically likely to process sensitive prompts, browsing context, or automation traces, so silent opt-in sharing materially increases privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest file, so vague-trigger review applies. The description advertises broad capabilities like 'One agent explores, all agents benefit' and 'Cloud-cached workflows' but provides no specific trigger phrases, scope limits, or exclusion conditions, which could lead to overly broad matching in systems that use manifest descriptions for skill discovery or invocation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Using a caret range for a runtime dependency allows new upstream releases to be installed without explicit review, which can introduce supply-chain risk or unexpected security regressions. In this skill's context, the dependency is an HTTP client and therefore likely processes network traffic, making dependency drift more operationally sensitive than a purely local library.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"start": "node dist/index.js"
  },
  "dependencies": {
    "undici": "^7.2.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"undici": "^7.2.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Static analysis

No suspicious patterns detected.