Livestock Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:57 AM UTC
• Version: 0.1.0

Overview

The skill appears to be a livestock assistant, but it asks for more AI-provider credentials and executable installation authority than its packaged files justify.

Install only if you are comfortable exposing AI-provider credentials to this skill environment, and prefer supplying only the single provider key you intend to use. Treat the package as incomplete unless the missing server files are supplied, and avoid running the unpinned ts-node install in a privileged environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:10
• Finding: Excessive Declaration of Sensitive AI Provider Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-19 **Vulnerability Type**: Excessive secret exposure through insecure configuration **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: requires: env: - OPENAI_API_KEY - ANTHROPIC_API_KEY - GOOGLE_GENERATIVE_AI_API_KEY bins: - node primaryEnv: OPENAI_API_KEY ``` ### Technical Analysis The Skill declares all three AI-provider API keys as required environment variables. This conflicts with `SKILL.md` lines 51-52, which state that only one provider key is necessary because the assistant automatically selects an available provider. Requiring credentials for every supported provider violates least-secret and least-privilege principles. A Skill runtime may make all declared variables available to the Skill process, unnecessarily placing multiple valuable credentials within the same trust boundary. The reviewed artifact also contains no executable implementation that uses these credentials, making their declaration unjustified by the packaged functionality. No credential-reading or exfiltration code was present in the audited files. Consequently, this finding identifies unnecessary credential exposure rather than confirmed credential theft. ### Attack Path 1. An operator installs or loads the Skill. 2. Based on the `requires.env` declaration, the runtime requests or provides all three AI-provider credentials. 3. The credentials become accessible within the Skill execution environment. 4. A compromised dependency, future implementation, or omitted externally supplied server component running in that environment could read every exposed credential. 5. The affected credentials could then be used against their respective provider accounts, subject to each key's configured permissions and quotas. ### Impact Assessment The exposed scope is limited to the permissions associated with the supplied OpenAI, Anthropic, and ...[truncated 417 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not declare all provider credentials as mandatory. 2. Request only the credential corresponding to the explicitly selected `AI_PROVIDER`. 3. If automatic provider selection must remain supported, represent provider keys as optional alternatives rather than simultaneous requirements. 4. Remove all credential requirements if the package remains documentation-only. 5. Ensure credentials are injected only into the process that needs them and are never logged, persisted, returned in errors, or inherited by unrelated child processes. 6. Apply provider-side restrictions, spending limits, monitoring, and key rotation. 7. Add automated tests verifying that selecting one provider does not expose credentials for the other providers. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:20
• Finding: Unpinned and Unnecessary Executable Node.js Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-24 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Low ### Vulnerable Code ```yaml emoji: "🐄" homepage: https://github.com/antonygiomarxdev/openclaw-livestock-assistant install: - kind: node package: ts-node bins: [ts-node] ``` ### Technical Analysis The installation metadata requests the `ts-node` package without an exact version, lockfile, or integrity digest. Resolution can therefore vary over time according to package-registry state and installer behavior. Third-party package installation may execute package lifecycle scripts and introduces transitive dependencies into the installation environment. An unpinned dependency reduces reproducibility and increases exposure to future package compromise or malicious transitive dependency updates. The risk is unnecessary for the reviewed artifact because it contains no TypeScript source, server implementation, or other executable code that could use `ts-node`. No evidence was found that the named package is currently malicious; this finding concerns avoidable and insufficiently constrained supply-chain exposure. ### Attack Path 1. An operator installs the Skill. 2. The installer resolves `ts-node` without an exact version or verified integrity value. 3. The package manager downloads the version and transitive dependency graph available under its resolution rules at installation time. 4. If the package, a transitive dependency, the registry, or the resolution channel is compromised, attacker-controlled installation or runtime code could execute. 5. Such code would run with the permissions granted to the package installer or Skill runtime. This path depends on compromise or unsafe resolution of the external dependency; no malicious package payload was included in the audited project. ### Impact Assessment Potential impact is bounded by the privileges of the instal ...[truncated 393 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `ts-node` installation declaration while the artifact contains no TypeScript implementation. 2. If executable TypeScript code is later included, prefer compiling it during a controlled build and shipping reviewed JavaScript rather than installing a runtime compiler for end users. 3. If `ts-node` is genuinely required, pin an exact reviewed version. 4. Include a lockfile and integrity metadata for the complete dependency graph. 5. Use a trusted registry and enable package provenance or signature verification where supported. 6. Disable dependency lifecycle scripts when they are not required. 7. Run installation with a non-privileged account in an isolated environment. 8. Add automated dependency scanning and review dependency changes before release. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete a session
```
DELETE /api/assistant/sessions/:sessionId
```
Response: `204 No Content`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Remove an animal
```
DELETE /api/animals/:id
```
Response: `204 No Content`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest says to use the skill for 'animal health, veterinary advice, breeds, reproduction, nutrition, forage, or any livestock-related topic,' which is a very broad natural-language trigger surface. It does not provide explicit boundaries or negative examples to distinguish when the skill should or should not activate, increasing the risk of accidental invocation from ordinary agricultural or animal-care conversations.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The documentation states the assistant 'Responds always in Spanish,' which imposes a language policy on all interactions. This is a natural-language policy concern because it does not offer the user a language preference or explain a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file explicitly instructs that 'Every interaction should be in Spanish,' reinforcing a mandatory language restriction. Because no alternative language path or user choice is provided, this conflicts with the requirement to avoid forced locale/language behavior unless clearly justified and opted into.

External Transmission

Medium

• Category: Data Exfiltration

Content

Create a session before sending messages:

```bash
curl -X POST http://localhost:3000/api/assistant/sessions
# → { "sessionId": "...", "welcome": "¡Hola! Soy el Asistente de Ganadería..." }

curl -X POST http://localhost:3000/api/assistant/sessions/<sessionId>/messages \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file documents session deletion via DELETE and presents only the HTTP response, but it does not warn that the operation removes conversation history. For markdown files, user-affecting or destructive behavior should be disclosed so users understand privacy and data-loss implications before invoking the action.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API reference documents DELETE /api/animals/:id without any accompanying caution that the animal record will be removed and may not be recoverable. In markdown documentation, destructive operations affecting user data should include an explicit warning about data loss or irreversibility.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file presents core disease headings and treatment terminology in Spanish while the surrounding reference text is in English. This imposes a mixed-language experience without documenting a locale requirement or offering user opt-in, which can violate language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The file is primarily written in English, but several table values switch to Spanish terms such as country names and abbreviations (for example, "Países Bajos", "Escocia", and "EE.UU."). Because the skill does not state that it is region-specific or give the user a language/locale option, this can violate the language/locale policy by implicitly forcing mixed-language output.

Static analysis

No suspicious patterns detected.