Business Agent Launchpad

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.1.0

Overview

This skill has a coherent business-agent setup purpose, but it asks the agent to run an unverified global npm install from an unspecified local folder.

Review this skill before installing. Only use it when you explicitly want to initialize an OpenClaw or Hermes business-agent workspace, and do not allow it to run `npm install -g .` unless you have verified the exact project directory and trust its package scripts. Prefer a pinned, local, reviewed CLI install path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:33
• Finding: Unverified Global npm Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-38` **Vulnerability Type**: Untrusted third-party installation with npm lifecycle execution **Risk Level**: High ### Vulnerable Code ```markdown If it is not installed, find the project folder and install it: ```bash npm install -g . ``` ``` ### Technical Analysis The skill directs the agent to find an unspecified project directory and install its contents globally with npm. The audited package does not include the referenced CLI implementation or a `package.json`, and it does not identify a trusted repository, pinned release, integrity hash, or signature for the project to be installed. Consequently, the effective code executed by this instruction cannot be verified from the reviewed artifact. By default, npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. If the selected directory contains an attacker-controlled npm package, `npm install -g .` can execute those scripts with the privileges of the invoking process. The global installation option also places package binaries and files in the configured global npm prefix, increasing the scope beyond a task-local workspace. ### Attack Path 1. An attacker creates or modifies a directory containing a malicious npm package. 2. The package defines a malicious lifecycle script or attacker-controlled command-line binary. 3. The agent fails to find `agent-launchpad` and follows the instruction to “find the project folder.” 4. The agent selects the attacker-controlled or otherwise unverified directory. 5. The agent executes `npm install -g .` from that directory. 6. npm runs the malicious lifecycle script during installation and installs attacker-controlled binaries into the global npm prefix. 7. The malicious code executes with the permissions of the user running npm and may also affect subsequent command invocations through the installed binary. ### Impact Assessment Successful exploitatio ...[truncated 579 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the instruction to “find the project folder” with an explicit, verified official package or repository source. 2. Pin the CLI to an exact version and verify its registry integrity hash, signature, or release checksum before installation. 3. Include the CLI source and dependency lockfile in the auditable distribution when possible. 4. Prefer a task-local installation over `npm install -g` to limit filesystem and command-resolution impact. 5. Disable lifecycle scripts with `--ignore-scripts` when they are not strictly required. 6. If lifecycle scripts are required, review them and all transitive dependencies before execution. 7. Require explicit user confirmation before installing software or executing package lifecycle code. 8. Run installation in a sandbox or least-privileged environment without unnecessary credentials, sensitive mounts, or administrative permissions. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a broad display/description and an explicit default prompt for generic business workflow initialization while also allowing implicit invocation. That combination can cause the platform to trigger this skill for vague office-work requests, leading to overbroad tool/workspace setup actions the user did not clearly request.

Static analysis

No suspicious patterns detected.