Axi Send File

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

The skill is meant to send workspace files through Telegram, but its broad triggers and unpinned runtime package install need review before use.

Install only if you are comfortable with requested files being sent through Telegram/OpenClaw MEDIA. Before use, confirm the exact file path being sent, avoid sensitive workspace files, and prefer a version that pins or preinstalls mdpdf instead of running pip during delivery.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Installation at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-44
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

# Install if not already present
pip install --user --break-system-packages mdpdf 2>/dev/null

# Convert markdown → PDF
~/.local/bin/mdpdf -o /tmp/output.pdf /path/to/input.md

Technical Analysis

The skill instructs the agent to install the mdpdf package from a package index at runtime without specifying an exact version, cryptographic hash, lockfile, or verified source. Consequently, the package content retrieved during execution may differ from what was reviewed.

Python package installation may execute attacker-controlled build or installation hooks. The package is then explicitly executed from ~/.local/bin/mdpdf, giving installed code access to the agent user's files and environment. The --break-system-packages option bypasses Python environment protections, and redirecting standard error to /dev/null suppresses diagnostics that could reveal installation failures, repository anomalies, or dependency conflicts.

The declared allowed-tools list permits Bash(mdpdf *) but does not declare pip, creating a mismatch between the skill's stated capability boundary and its installation instructions.

Attack Path

1. An attacker compromises the upstream mdpdf release, one of its transitive dependencies, or the package distribution channel.
2. A user requests delivery of a Markdown file, causing the agent to follow the documented conversion workflow.
3. If mdpdf is unavailable, the agent runs the unpinned pip install command.
4. The package index returns the compromised or unexpectedly changed package version.
5. Malicious code executes through package build or installation hooks, or when ~/.local/bin/mdpdf is subsequently invoked.
6. The malicious code runs with the privileges of the agent's operating-system account and c ...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

• Preinstall and security-review mdpdf in a controlled build environment instead of installing it during skill execution.
• Pin an audited exact version and all transitive dependencies using a lockfile.
• Require cryptographic hashes, such as with pip install --require-hashes, and use only an explicitly trusted package index.
• Remove --break-system-packages; install the dependency in an isolated virtual environment or immutable container.
• Remove 2>/dev/null so installation warnings and integrity failures remain visible and auditable.
• Prohibit runtime package installation through the skill's capability policy. If installation is genuinely required, declare and narrowly constrain the package-management capability.
• Execute the converter in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted network connectivity.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is designed to transmit local workspace files through Telegram but does not prominently warn that using it sends data to an external third-party service. Users may believe they are performing a local format conversion only, leading to unintentional disclosure of sensitive workspace contents outside the trusted environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

- Bash(zip *)
  - Bash(cp *)
  - Bash(ls *)
  - Bash(mkdir *)
---

# send-file

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad ('download', 'attach', 'share this') and can match ordinary conversation, increasing the chance the skill activates in contexts where the user did not specifically intend file exfiltration through Telegram. Because this skill moves workspace files to an external channel, accidental invocation materially raises the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The section is labeled "Multiple markdown files" and the subsequent zip command packages report1.pdf and report2.pdf, but the preceding mdpdf commands output /tmp/report1.md and /tmp/report2.md. This is an active contradiction in the documentation that could cause the skill to fail when followed as written.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.