Solar Cloud API

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:52 PM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: fetch Solax inverter summary data using user-provided Solax credentials, with some normal dependency and credential-handling cautions.

Before installing, treat the Solax token as a secret, run the npm install and script in a limited environment, and consider adding or reviewing a package-lock.json for reproducible dependency installation. The skill is narrow, but it will send your Solax token and inverter serial number to the Solax Cloud API through the solax-cloud-api package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Dependency Installation Without a Lockfile or Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-19; scripts/package.json:1-8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill instructs users to install a third-party npm dependency without providing a lockfile:

markdown

## Setup (one-time)

This skill uses Node.js and the npm package `solax-cloud-api`.

Install dependencies inside the skill folder:

```bash
cd /home/openclaw/.openclaw/workspace/skills/solax-summary-fetch/scripts
npm install

(We use npm install instead of npm ci because this skill does not ship with a lockfile.)

text

The complete package manifest is:

```json
{
  "name": "solax-summary-fetch-scripts",
  "private": true,
  "type": "module",
  "dependencies": {
    "solax-cloud-api": "0.2.0"
  }
}

Technical Analysis

The direct dependency is pinned to version 0.2.0, which limits direct version drift. However, the project does not include a package-lock.json, so npm must resolve the dependency graph during each installation. Transitive versions and package integrity hashes are therefore not fixed or reviewable from the audited project.

In addition, a normal npm install may execute dependency lifecycle scripts such as preinstall, install, or postinstall. Such scripts run with the privileges of the user performing the installation. The source and transitive dependency graph of solax-cloud-api were not included in the audited artifact, so their installation behavior, API destination, and handling of the Solax token and serial number could not be verified.

This is a supply-chain exposure rather than evidence that the named dependency is currently malicious.

Attack Path

1. An attacker compromises a transitive package resolved by solax-cloud-api, its registry account, or the package distribution channel.
2. The attacker publishes a malicious compatible release or modifies an installation artifact. ...[truncated 1047 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate and commit a reviewed package-lock.json so direct and transitive package versions and integrity hashes are reproducible.
2. Replace the setup instruction with npm ci, which installs exactly the locked dependency graph and fails if the manifest and lockfile differ.
3. Review the source, maintainership, publication history, lifecycle scripts, and transitive dependencies of solax-cloud-api@0.2.0.
4. If no dependency lifecycle scripts are required, install with npm ci --ignore-scripts.
5. Run installation and execution under a dedicated, unprivileged account or sandbox with access only to the files and network destinations required for the Solax API request.
6. Use dependency auditing and provenance controls in CI, and regenerate the lockfile only through a documented review process.
7. Restrict outbound network access to the verified Solax API endpoint after confirming the dependency's actual destination and transport-security behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Yes, there is a mismatch. The declared description describes an operational skill that retrieves live inverter summary data from Solax Cloud given credentials and an inverter serial number. The actual supplied code chunk is only a TypeScript declaration file containing a permissive SolaxSummary interface and comments. It has no executable behavior and does not implement the described fetch capability. This is a materially different primary purpose, not just a supporting detail.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill explicitly relies on environment variables containing secrets (SOLAX_TOKENID) and instructs executing local Node.js code, but it declares no tool scope or permission boundaries. That omission can lead to overbroad execution context and unclear secret access expectations, increasing the risk that credentials are accessed or exposed without explicit authorization controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads SOLAX_TOKENID and SOLAX_SN from environment variables, which may contain sensitive account or device identifiers. The file does not include a docstring, comment, or user-facing notice explaining that these sensitive values are consumed and used for external API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script performs an external API request via api.getAPIData() using tokenId and sn, which are sourced from CLI arguments or environment variables. While error handling exists, there is no user-facing warning, confirmation, or descriptive comment near the operation explaining that credential-backed data will be transmitted to the Solax service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.