Config Validator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:12 PM UTC
• Version: 1.0.0

Overview

This is a local configuration checker that reads expected project config files and reports problems, with no evidence of exfiltration, persistence, or destructive behavior.

Before installing, treat this as a local project config checker that will read your .env file. It does not appear to leak secrets, but update the npm dependencies, review any future implementation of --fix before using it, and do not rely on it to fail closed when required environment variables are missing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

// Determine workspace root
const WORKSPACE_ROOT = path.resolve(__dirname, '../../');
const ENV_FILE = path.join(WORKSPACE_ROOT, '.env');
const OPENCLAW_JSON = path.join(WORKSPACE_ROOT, 'openclaw.json');
const PACKAGE_JSON = path.join(WORKSPACE_ROOT, 'package.json');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

function checkEnv() {
    log('Checking .env file...');
    if (!fs.existsSync(ENV_FILE)) {
        log('Error: .env file missing!', 'ERROR');
        return { valid: false, issues: ['Missing .env file'] };

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

function checkEnv() {
    log('Checking .env file...');
    if (!fs.existsSync(ENV_FILE)) {
        log('Error: .env file missing!', 'ERROR');
        return { valid: false, issues: ['Missing .env file'] };

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}

function checkEnv() {
    log('Checking .env file...');
    if (!fs.existsSync(ENV_FILE)) {
        log('Error: .env file missing!', 'ERROR');
        return { valid: false, issues: ['Missing .env file'] };

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: brace-expansion 1.1.12 is flagged with multiple DoS advisories, and it is present in the resolved dependency tree. Even though it is a transitive dev dependency, vulnerable glob/pattern expansion can still be triggered during local development or CI runs, causing excessive CPU or memory consumption.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: minimatch 3.1.2 has multiple ReDoS advisories and appears in the dependency tree as a transitive dependency of glob. Crafted glob patterns can trigger catastrophic backtracking or heavy computation, which is especially relevant in CI or developer tooling that accepts untrusted patterns.

Known Vulnerable Dependency: js-yaml==4.1.0 — 5 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +2 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: js-yaml 4.1.0 is associated with multiple CPU exhaustion issues, and the exact version is locked in this file. Although it is a dev dependency used through mocha, parsing attacker-controlled YAML in test infrastructure or automation could still enable denial of service.

Known Vulnerable Dependency: minimatch==4.2.1 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: minimatch 4.2.1 is separately present and flagged for ReDoS issues, so this is not duplicative of the 3.1.2 finding. Any code path that evaluates attacker-controlled glob expressions through this version may suffer excessive CPU consumption and service slowdown.

Known Vulnerable Dependency: nanoid==3.3.1 — 4 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2024-55565 (Predictable results in nanoid generation when given non-integer values) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: nanoid 3.3.1 is present and has advisories covering predictable output and potential infinite-loop conditions in certain generator misuse cases. In this context it is a dev dependency pulled by mocha, which lowers direct production exposure, but it can still affect tooling integrity or availability if unsafe code paths are exercised.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: picomatch 2.3.1 is locked in and carries method-injection/ReDoS style advisories related to crafted glob patterns. Since picomatch is commonly used for file matching, malicious patterns in automation, tests, or developer tooling can lead to incorrect matching or denial of service.

Known Vulnerable Dependency: serialize-javascript==6.0.0 — 3 advisory(ies): GHSA-5c6j-r48x-rmvq (Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to); CVE-2024-11831 (Cross-site Scripting (XSS) in serialize-javascript); CVE-2026-34043 (Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: serialize-javascript 6.0.0 has high-severity advisories including potential RCE/XSS depending on how serialized output is consumed, and the vulnerable version is present as a mocha dependency. Even in dev/test tooling, serializing attacker-controlled objects and later embedding or evaluating the result can create serious compromise paths.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documentation advertises a `--fix` mode that can create or repair configuration files, but it does not clearly warn that running this mode may modify important project files. In an agent or automation context, unclear disclosure about write-capable behavior can lead to unintended configuration changes, overwrites, or environment drift if a user assumes the tool is read-only validation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script advertises that it ensures critical configurations are present, but in checkEnv() missing critical environment variables are only logged as warnings and the result is still marked valid. This can let the system proceed in a misconfigured state, causing downstream failures or insecure fallback behavior if other components assume required secrets and connection settings were verified.

Known Vulnerable Dependency: diff==5.0.0 — 1 advisory(ies): CVE-2026-24001 (jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch)

Low

• Category: Supply Chain
• Confidence: 77% confidence
• Finding: diff 5.0.0 is listed with a DoS advisory affecting patch parsing/application logic, and the lockfile confirms that exact version is installed. In this skill context it is only a dev dependency via mocha, so exposure is limited to test or CI workflows unless untrusted patch data is processed there.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "OpenClaw Evolver",
  "license": "MIT",
  "dependencies": {
    "dotenv": "^16.0.0"
  },
  "devDependencies": {
    "chai": "^4.3.0",

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dotenv": "^16.0.0"
  },
  "devDependencies": {
    "chai": "^4.3.0",
    "mocha": "^9.0.0"
  },
  "engines": {

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "chai": "^4.3.0",
    "mocha": "^9.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.