Plugin Publisher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with plugin publishing, but it can drive high-impact GitHub and installer-script actions with weak confirmation boundaries and an unsafe shell-template pattern.

Install only if you are comfortable with a skill that can create files, generate executable installers, and publish to GitHub. Before using it, require explicit review before any commit, push, repo creation, or installer execution, and sanitize plugin names and display text used in generated shell scripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/openclaw-generator-template.sh:39
• Finding: Unsafe Remote Installer Execution Through curl-to-Bash Instruction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw-generator-template.sh:39-42` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash if ! command -v openclaw &> /dev/null; then err "OpenClaw not found. Install: curl -fsSL https://openclaw.ai/install.sh | bash" exit 1 fi ``` ### Technical Analysis When OpenClaw is unavailable, the generated deployment script instructs the user to pipe a remotely downloaded script directly into Bash: ```bash curl -fsSL https://openclaw.ai/install.sh | bash ``` The command does not pin a release, validate a cryptographic signature, or verify a checksum. It also prevents the user from inspecting the complete downloaded artifact before execution. The effective code can change after this Skill has been reviewed. The deployment script only prints the command and does not execute it automatically. Nevertheless, it presents the command as the prescribed installation procedure, creating a direct remote-code-execution channel if the user follows the instruction. This behavior is not necessary for the Skill's declared plugin-publishing functionality. A safer installation workflow can direct users to official documentation or download and verify a fixed release artifact before execution. ### Attack Path 1. A user runs a generated `openclaw-install.sh` without OpenClaw installed. 2. The prerequisite check displays the curl-to-Bash installation command. 3. The user executes the recommended command. 4. `curl` retrieves the current contents of `https://openclaw.ai/install.sh`. 5. Bash executes those contents immediately without integrity or provenance verification. 6. If the domain, hosting service, DNS resolution, TLS endpoint, or upstream installer is compromised, attacker-controlled commands execute with the user's privileges. ### Impact Assessment A malicious remote installer could perform arbitrary actions available to the invoking user, in ...[truncated 544 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the curl-to-Bash recommendation. 2. Direct users to official installation documentation and require manual review of installation steps. 3. Prefer a trusted package manager or a version-pinned release artifact. 4. If a script must be downloaded: - Download it to a local file rather than piping it into a shell. - Pin an immutable version or release URL. - Publish and verify a SHA-256 checksum. - Prefer cryptographic signature verification with a pinned public key. - Let the user inspect the file before executing it. 5. Avoid recommending elevated execution unless a documented installation step strictly requires it. A safer pattern is: ```bash version="PINNED_VERSION" url="https://example.invalid/releases/${version}/install.sh" expected_sha256="PINNED_SHA256" curl --fail --show-error --location "$url" --output openclaw-install.sh printf '%s %s\n' "$expected_sha256" openclaw-install.sh | sha256sum --check - less openclaw-install.sh bash openclaw-install.sh ``` The actual URL, version, checksum, and verification mechanism must come from a trusted and independently verifiable release process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openclaw-generator-template.sh:83
• Finding: Shell Command Injection Through Unescaped Template Substitutions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw-generator-template.sh:83-96` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # --- Initial memory seed ------------------------------------- TODAY=$(date +%Y-%m-%d) cat > "$WORKSPACE/memory/$TODAY.md" << EOF # Memory — $TODAY ## Agent Initialized - {{AGENT_DISPLAY_NAME}} deployed to OpenClaw - Workspace: $WORKSPACE - Ready for use ## Notes - Claude plugin format adapted for OpenClaw single-context execution - All agent perspectives run sequentially with mental isolation discipline EOF ``` Related placeholders are also inserted into shell assignments at lines 14-15: ```bash WORKSPACE="$OPENCLAW_HOME/agents/{{PLUGIN_NAME}}" PLUGIN_DIR="$SCRIPT_DIR/{{PLUGIN_NAME}}" ``` ### Technical Analysis The template places generated metadata directly into executable shell source without defining a robust escaping or validation mechanism. The initial-memory heredoc uses an unquoted delimiter: ```bash << EOF ``` Bash performs parameter expansion, command substitution, and arithmetic expansion in an unquoted heredoc. If a generated value contains shell syntax such as `$(command)` or backtick command substitution, that syntax can execute when the generated installation script runs. For example, if an untrusted display name were inserted as: ```text $(attacker-controlled-command) ``` the resulting heredoc would contain: ```bash - $(attacker-controlled-command) deployed to OpenClaw ``` Bash would execute `attacker-controlled-command` while constructing the memory file. The plugin-name placeholders in double-quoted assignments create an additional injection surface if substitution values can contain a double quote followed by shell syntax. `SKILL.md` specifies kebab-case rules for plugin names, but the shell template does not enforce those rules itself, and no equivalent strict validation is documented for the display name. Because the reviewed p ...[truncated 1603 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate every identifier before generating shell code: - Restrict plugin names to a strict allowlist such as `^[a-z0-9]+(-[a-z0-9]+)*$`. - Reject path separators, quotes, control characters, substitutions, and shell metacharacters. 2. Never place untrusted display text directly into executable shell source. 3. Use a quoted heredoc delimiter for static content: ```bash cat > "$target" <<'EOF' Static content with no shell expansion. EOF ``` 4. For dynamic values, write them separately with `printf` and treat them strictly as data: ```bash { printf '%s\n' '# Memory' printf '%s\n' '## Agent Initialized' printf -- '- %s deployed to OpenClaw\n' "$AGENT_DISPLAY_NAME" printf -- '- Workspace: %s\n' "$WORKSPACE" } > "$WORKSPACE/memory/$TODAY.md" ``` 5. Pass generated values through runtime variables rather than embedding them into the shell program. 6. If source generation is unavoidable, apply context-appropriate shell escaping using a well-tested mechanism and add tests for: - `$()` and backticks. - Single and double quotes. - Newlines and carriage returns. - Semicolons, pipes, redirections, and ampersands. - Path traversal sequences. 7. Run a shell linter and automated adversarial test suite against every generated installer before delivery. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger guidance is excessively broad, including cases where the user 'just say[s] plugin' and asserting the skill is 'probably what they need.' This can cause unintended invocation in unrelated contexts, which is especially risky because the skill can scaffold files, prepare scripts, restructure repos, and initiate publication workflows that may alter project state or expose code externally.

Ae1

High

• Category: analysis-evasion

Content

Each skill is a directory with a `SKILL.md` file. Skills trigger automatically when Claude

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`references/openclaw-template.md` for the template and adaptation rules.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

info "Checking prerequisites..."

if ! command -v openclaw &> /dev/null; then
    err "OpenClaw not found. Install: curl -fsSL https://openclaw.ai/install.sh | bash"
    exit 1
fi
log "OpenClaw: $(openclaw --version 2>/dev/null || echo 'installed')"

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs the agent to perform shell-capable actions such as creating repos with `gh`, running `git`, zipping files, and generating install scripts, but it does not declare an explicit tool scope or allowed-tools boundary in the skill itself. That increases the chance of the skill being invoked with broader-than-expected execution capability and reduces transparency about what destructive or external actions may occur.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs creation of GitHub repos, commits, pushes, and generation of executable install/push scripts without an explicit safety interlock requiring informed user consent immediately before those actions. In context, this is more dangerous because the skill's purpose is end-to-end publishing and distribution, so unintended execution could leak private code, alter remote repositories, or hand the user scripts that make consequential system and VCS changes.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

## Component Schemas (Summary)

### Skills
- Location: `skills/skill-name/SKILL.md`
- Frontmatter: `name` (required), `description` (required), `version` (optional)
- Description: third-person with trigger phrases in quotes
- Body: imperative instructions, under 3,000 words

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# Copy skills
cp "$PLUGIN_DIR/skills/methodology/SKILL.md" "$WORKSPACE/skills/methodology/SKILL.md"
cp "$PLUGIN_DIR/skills/validate/SKILL.md" "$WORKSPACE/skills/methodology/ORCHESTRATOR.md"

# Copy agents as skill-readable prompts

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# Copy skills
cp "$PLUGIN_DIR/skills/methodology/SKILL.md" "$WORKSPACE/skills/methodology/SKILL.md"
cp "$PLUGIN_DIR/skills/validate/SKILL.md" "$WORKSPACE/skills/methodology/ORCHESTRATOR.md"

# Copy agents as skill-readable prompts
for agent in "$PLUGIN_DIR/agents/"*.md; do

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The template explicitly states that the agent is triggered through natural conversation rather than a constrained command surface. In a plugin-publishing/install context, that broad activation model can cause unintended execution of workflows or prompt-based instruction following when ambiguous user text is interpreted as authorization to act, increasing prompt-injection and accidental action risk.

Static analysis

No suspicious patterns detected.