Competitor Trial Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:23 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its stated clinical-trial monitoring purpose, but its installation instructions introduce avoidable risk by asking users to install unnecessary unpinned Python packages while also saying no packages are required.

Review this skill before installing. The core script appears limited to user-directed clinical-trial monitoring, but users should avoid the documented pip install step unless the publisher fixes the dependency instructions, pins any real dependencies, or confirms that the script needs no external Python packages. Be aware that the tool stores watchlists and alert history in your home directory under ~/.openclaw/competitor-trial-monitor and sends queried NCT IDs to ClinicalTrials.gov.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:112

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 112–117
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

## Dependencies

```bash
pip install requests python-dateutil
```

Technical Analysis

The documented installation command retrieves mutable, unpinned versions of requests and python-dateutil from pip's configured package index. It does not use a lock file, exact version constraints, integrity hashes, or an explicitly trusted package source.

Neither dependency is imported by scripts/main.py. The implementation instead uses Python standard-library modules such as urllib.request and datetime. Moreover, SKILL.md later states that no additional Python packages are required. The installation instruction therefore introduces avoidable supply-chain exposure without supporting the implemented functionality.

This does not prove that either named package is malicious. The risk arises because the versions and artifacts installed in the future can differ from those available at audit time, and pip may use a user-configured or compromised package index.

Attack Path

1. A user follows the documented dependency installation instructions.
2. pip resolves the latest matching package distributions using its configured indexes and mirrors.
3. An attacker compromises an upstream release, distribution artifact, package index, mirror, or local pip configuration.
4. pip downloads and installs the attacker-controlled distribution.
5. Malicious installation or package code executes in the installation environment with the privileges of the user running pip.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation. The resulting scope may include access to that user's files, environment variables, credentials readable by the user, and ne ...[truncated 269 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install requests python-dateutil instruction because the current implementation does not use either package.
2. Reconcile the dependency documentation so it consistently states that the script uses only the Python standard library.
3. If third-party dependencies are introduced later, declare only packages actually imported by the implementation.
4. Pin each dependency to a reviewed exact version in a lock file.
5. Require cryptographic hashes for downloaded artifacts, such as with pip's --require-hashes option.
6. Use an explicitly trusted package index or controlled internal mirror.
7. Add automated dependency and artifact scanning to the release process.
8. Install dependencies in an isolated, least-privilege virtual environment rather than a privileged or system-wide environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises high-risk capabilities such as file read/write and network/API access, but it does not declare an explicit tool scope like permissions or allowed-tools. This creates ambiguity for reviewers and enforcement systems, increasing the chance the skill receives broader runtime capabilities than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes persistent local storage under ~/.openclaw and regular outbound requests to external registries, but it does not clearly warn users about ongoing data retention or network transmission. In a monitoring workflow, this can lead to unanticipated persistence of competitive intelligence and unnoticed outbound traffic, which raises privacy, compliance, and operational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents user-facing natural language in both English and Chinese, and most runtime output/help text is Chinese-only for key status and warning messages. This can amount to a language/locale policy issue because the skill implicitly forces a specific language for important user interactions without documented user opt-in or locale selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prerequisites section states 'No additional Python packages required,' which directly conflicts with the dependencies section listing 'requests' and 'python-dateutil' as required installs. This is an active documentation contradiction rather than a mere omission.

Content

No source excerpt is available for this finding.