Plugin Publisher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with plugin publishing, but it can drive high-impact GitHub and installer-script actions with weak confirmation boundaries and an unsafe shell-template pattern.

Install only if you are comfortable with a skill that can create files, generate executable installers, and publish to GitHub. Before using it, require explicit review before any commit, push, repo creation, or installer execution, and sanitize plugin names and display text used in generated shell scripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/openclaw-generator-template.sh:39

Finding

Unsafe Remote Installer Execution Through curl-to-Bash Instruction

Content

View full analysis

/dev/null; then err "OpenClaw not found. Install: curl -fsSL https://openclaw.ai/install.sh | bash" exit 1 fi ``` ### Technical Analysis When OpenClaw is unavailable, the generated deployment script instructs the user to pipe a remotely downloaded script directly into Bash: ```bash curl -fsSL https://openclaw.ai/install.sh | bash ``` The command does not pin a release, validate a cryptographic signature, or verify a checksum. It also prevents the user from inspecting the complete downloaded artifact before execution. The effective code can change after this Skill has been reviewed. The deployment script only prints the command and does not execute it automatically. Nevertheless, it presents the command as the prescribed installation procedure, creating a direct remote-code-execution channel if the user follows the instruction. This behavior is not necessary for the Skill's declared plugin-publishing functionality. A safer installation workflow can direct users to official documentation or download and verify a fixed release artifact before execution. ### Attack Path 1. A user runs a generated `openclaw-install.sh` without OpenClaw installed. 2. The prerequisite check displays the curl-to-Bash installation command. 3. The user executes the recommended command. 4. `curl` retrieves the current contents of `https://openclaw.ai/install.sh`. 5. Bash executes those contents immediately without integrity or provenance verification. 6. If the domain, hosting service, DNS resolution, TLS endpoint, or upstream installer is compromised, attacker-controlled commands execute with the user's privileges. ### Impact Assessment A malicious remote installer could perform arbitrary actions available to the invoking user, in ...[truncated 544 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openclaw-generator-template.sh:83

Finding

Shell Command Injection Through Unescaped Template Substitutions

Content

View full analysis

"$WORKSPACE/memory/$TODAY.md" << EOF # Memory — $TODAY ## Agent Initialized - {{AGENT_DISPLAY_NAME}} deployed to OpenClaw - Workspace: $WORKSPACE - Ready for use ## Notes - Claude plugin format adapted for OpenClaw single-context execution - All agent perspectives run sequentially with mental isolation discipline EOF ``` Related placeholders are also inserted into shell assignments at lines 14-15: ```bash WORKSPACE="$OPENCLAW_HOME/agents/{{PLUGIN_NAME}}" PLUGIN_DIR="$SCRIPT_DIR/{{PLUGIN_NAME}}" ``` ### Technical Analysis The template places generated metadata directly into executable shell source without defining a robust escaping or validation mechanism. The initial-memory heredoc uses an unquoted delimiter: ```bash << EOF ``` Bash performs parameter expansion, command substitution, and arithmetic expansion in an unquoted heredoc. If a generated value contains shell syntax such as `$(command)` or backtick command substitution, that syntax can execute when the generated installation script runs. For example, if an untrusted display name were inserted as: ```text $(attacker-controlled-command) ``` the resulting heredoc would contain: ```bash - $(attacker-controlled-command) deployed to OpenClaw ``` Bash would execute `attacker-controlled-command` while constructing the memory file. The plugin-name placeholders in double-quoted assignments create an additional injection surface if substitution values can contain a double quote followed by shell syntax. `SKILL.md` specifies kebab-case rules for plugin names, but the shell template does not enforce those rules itself, and no equivalent strict validation is documented for the display name. Because the reviewed p ...[truncated 1603 chars]

Remediation

View remediation

"$target" <<'EOF' Static content with no shell expansion. EOF ``` 4. For dynamic values, write them separately with `printf` and treat them strictly as data: ```bash { printf '%s\n' '# Memory' printf '%s\n' '## Agent Initialized' printf -- '- %s deployed to OpenClaw\n' "$AGENT_DISPLAY_NAME" printf -- '- Workspace: %s\n' "$WORKSPACE" } > "$WORKSPACE/memory/$TODAY.md" ``` 5. Pass generated values through runtime variables rather than embedding them into the shell program. 6. If source generation is unavoidable, apply context-appropriate shell escaping using a well-tested mechanism and add tests for: - `$()` and backticks. - Single and double quotes. - Newlines and carriage returns. - Semicolons, pipes, redirections, and ampersands. - Path traversal sequences. 7. Run a shell linter and automated adversarial test suite against every generated installer before delivery. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger guidance is excessively broad, including cases where the user 'just say[s] plugin' and asserting the skill is 'probably what they need.' This can cause unintended invocation in unrelated contexts, which is especially risky because the skill can scaffold files, prepare scripts, restructure repos, and initiate publication workflows that may alter project state or expose code externally.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

Each skill is a directory with a `SKILL.md` file. Skills trigger automatically when Claude

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md

`references/openclaw-template.md` for the template and adaptation rules.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/openclaw-generator-template.sh (reported line 40)May include surrounding context.

sh

info "Checking prerequisites..."

if ! command -v openclaw &> /dev/null; then
    err "OpenClaw not found. Install: curl -fsSL https://openclaw.ai/install.sh | bash"
    exit 1
fi
log "OpenClaw: $(openclaw --version 2>/dev/null || echo 'installed')"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly instructs the agent to perform shell-capable actions such as creating repos with gh, running git, zipping files, and generating install scripts, but it does not declare an explicit tool scope or allowed-tools boundary in the skill itself. That increases the chance of the skill being invoked with broader-than-expected execution capability and reduces transparency about what destructive or external actions may occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs creation of GitHub repos, commits, pushes, and generation of executable install/push scripts without an explicit safety interlock requiring informed user consent immediately before those actions. In context, this is more dangerous because the skill's purpose is end-to-end publishing and distribution, so unintended execution could leak private code, alter remote repositories, or hand the user scripts that make consequential system and VCS changes.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/marketplace-structure.md (reported line 172)May include surrounding context.

md

## Component Schemas (Summary)

### Skills
- Location: `skills/skill-name/SKILL.md`
- Frontmatter: `name` (required), `description` (required), `version` (optional)
- Description: third-person with trigger phrases in quotes
- Body: imperative instructions, under 3,000 words

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/openclaw-template.md (reported line 183)May include surrounding context.

bash

# Copy skills
cp "$PLUGIN_DIR/skills/methodology/SKILL.md" "$WORKSPACE/skills/methodology/SKILL.md"
cp "$PLUGIN_DIR/skills/validate/SKILL.md" "$WORKSPACE/skills/methodology/ORCHESTRATOR.md"

# Copy agents as skill-readable prompts

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/openclaw-template.md (reported line 184)May include surrounding context.

bash

# Copy skills
cp "$PLUGIN_DIR/skills/methodology/SKILL.md" "$WORKSPACE/skills/methodology/SKILL.md"
cp "$PLUGIN_DIR/skills/validate/SKILL.md" "$WORKSPACE/skills/methodology/ORCHESTRATOR.md"

# Copy agents as skill-readable prompts
for agent in "$PLUGIN_DIR/agents/"*.md; do

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly states that the agent is triggered through natural conversation rather than a constrained command surface. In a plugin-publishing/install context, that broad activation model can cause unintended execution of workflows or prompt-based instruction following when ambiguous user text is interpreted as authorization to act, increasing prompt-injection and accidental action risk.

Content

No source excerpt is available for this finding.