OpenClaw Cofounder Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:48 AM UTC
• Version: 1.2.1

Overview

The skill is a disclosed CoFounder.im integration that fetches project plans and only proceeds to build actions after user approval, with a supply-chain caution for unpinned install commands.

Before installing, use a trusted or pinned installer version where possible, run builds in a clean project directory or container, and review every fetched CoFounder.im build phase before approving sub-agents, dependency installs, network access, or verification commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:35

Finding

Unpinned Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 35–41
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx skills add cofounder-im/openclaw-cofounder-skill

bash

npx clawhub install cofounder-im

Technical Analysis

The installation instructions invoke the skills and clawhub npm packages through npx without specifying reviewed package versions or integrity hashes. If these packages are not already available locally, npx may retrieve their current releases from the configured npm registry and immediately execute their CLI code.

Consequently, the effective executable payload can change after this Skill has been reviewed. The repository argument supplied to skills add identifies the Skill source, but it does not pin or verify the executable skills package itself. The same issue applies to the clawhub command.

This is a supply-chain weakness rather than evidence that the currently published packages are malicious. Exploitation would require compromise of a relevant package, publisher account, registry, dependency, or package-resolution path.

Attack Path

1. An attacker compromises a relevant npm publisher account, package release, transitive dependency, registry path, or similarly applicable package-resolution source.
2. The attacker publishes a malicious version that remains compatible with the unversioned command.
3. A user follows the documented installation instructions.
4. npx resolves and downloads the mutable package version from the configured registry.
5. The downloaded package's CLI or lifecycle code executes with the privileges of the user running the command.
6. The malicious code can access resources available to that user before or during Skill installation.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's privileges. Dependin ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each executable package to a reviewed exact version, for example:

   bash

   npx --yes skills@<reviewed-exact-version> add cofounder-im/openclaw-cofounder-skill
   npx --yes clawhub@<reviewed-exact-version> install cofounder-im
   

2. Verify that the package name, publisher, registry, and expected version are explicitly documented.
3. Prefer installing dependencies through a lockfile-backed workflow with npm integrity metadata rather than resolving mutable versions at execution time.
4. Publish checksums, signatures, or provenance attestations for reviewed releases and verify them before execution.
5. Disable or review lifecycle scripts where practical, and run installation in a sandbox or minimally privileged environment without unrelated secrets.
6. Establish a controlled upgrade process in which new versions are reviewed and tested before the documentation is updated.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes autonomous building, parsing build specs into sub-agent tasks, and coordinated execution, but does not clearly warn users that this can modify source code, create files, run commands, or otherwise affect their environment. In an agent-skill context, absence of explicit consent and safety boundaries materially increases the chance of unsafe execution, especially when the fetched build spec is externally sourced content that could steer agent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add cofounder-im/openclaw-cofounder-skill without pinning a specific version. This allows installation of whatever package/version is current at execution time, creating a supply-chain risk if the package is compromised, unpublished/republished, or updated with malicious behavior. In this skill’s context, that risk is heightened because the installed artifact is meant to orchestrate project building and sub-agents, increasing downstream impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README similarly uses npx clawhub install cofounder-im without a pinned version, so users may fetch and execute a mutable package at install time. This is a classic supply-chain exposure and is more concerning here because the resulting skill integrates with agent workflows and may influence automated coding or system actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.