NovelAI OpenClaw Adaptor

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.1

Overview

This skill is configuration guidance for a local NovelAI adaptor and does not contain hidden execution, persistence, or credential collection behavior.

Before installing, verify the adaptor package source, maintainer, repository, and release version. Prefer a trusted local checkout or pinned reviewed version, use an isolated environment, and enter NovelAI credentials only through the local configuration flow, never in chat or inline shell commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Package Installation Without Verifiable Provenance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–55
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

Safe examples:

```bash
pip install novelai-openclaw-adaptor

bash

novelai-config init

text

### Technical Analysis

The Skill presents installation of `novelai-openclaw-adaptor` from pip as a safe example, but the command does not specify a trusted version, package hash, verified repository, or authenticated package source. Consequently, package identity and integrity depend entirely on the package index and its current publisher.

Although the surrounding instructions tell users to verify the package source and obtain approval before installation, these are procedural safeguards rather than technical controls. The command itself permits pip to retrieve the latest available release and its transitive dependencies. The effective code executed can therefore change after the Skill has been audited.

Running `novelai-config init` subsequently executes code supplied by the installed package. Because this initialization process is expected to accept a NovelAI credential through local input, a compromised package could capture that credential. Its code would also execute with the operating-system privileges of the invoking user.

This creates a supply-chain exposure involving possible package compromise, maintainer-account takeover, malicious releases, or unsafe transitive dependencies. No evidence in the audited file establishes that the named package is currently malicious; the finding concerns the unsafe, unauthenticated installation mechanism.

### Attack Path

1. An attacker publishes or gains control of a malicious release of `novelai-openclaw-adaptor`, or compromises one of its transitive dependencies.
2. A user follows the documented `pip install novelai-openclaw-adaptor` command.
3. Pip resolves and installs the attacker-controlled release b
...[truncated 1273 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unpinned installation example with an exact, reviewed version:

   bash

   python -m pip install "novelai-openclaw-adaptor==<verified-version>"
   

2. Provide the authoritative project repository and package-index URLs so users can verify that the package name, publisher, and source repository correspond.

3. Publish and require cryptographic hashes through a reviewed requirements file:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Pin and hash all transitive dependencies, not only the top-level package.

5. Prefer installation from a verified local source checkout at an audited commit. Document the exact commit identifier and verify signed tags or releases when available.

6. Do not label a generic, unpinned pip command as a “safe example.” Explicitly state that installation must stop if the source, maintainer, release, or integrity metadata cannot be independently verified.

7. Recommend using an isolated virtual environment and a non-privileged operating-system account. Explicitly warn users not to run the installation or initialization with administrator or root privileges.

8. Keep credentials out of command-line arguments and environment logs. Continue using interactive local credential entry, but clarify that credentials should only be entered after the installed package and exact release have been verified.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

1. Treat installation as optional and approval-based.
2. Before suggesting installation, tell the user to verify the package source, maintainer, and repository or project page.
3. Prefer local source checkout or an already-verified package source when available.
4. Never ask the user to paste a NovelAI API key into chat.
5. Never include secrets inline in command examples.
6. If the package source cannot be verified, stop at configuration guidance and ask the user how they want to proceed.

Static analysis

No suspicious patterns detected.