AxonFlow Governance Policies

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:49 AM UTC
• Version: 2.5.0

Overview

This is a clear setup guide for a governance plugin, with the main risk being that it asks users to install and configure a third-party plugin and credentials.

Install only if you trust AxonFlow and the OpenClaw plugin registry path. Treat the configured client secret as sensitive, use a secret manager as instructed, and prefer an isolated or least-privilege OpenClaw environment for initial testing because the downloaded plugin code itself was not included in this skill artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Third-Party Plugin Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The setup guide instructs users to download and install executable third-party plugin code. Although the dependency is pinned to a specific version, the instructions provide no cryptographic checksum, signature-verification procedure, signed provenance, or immutable source commit for validating the downloaded artifact.

Complete Code Snippet:

markdown

## Install

```bash
openclaw plugins install @axonflow/openclaw@2.6.4

Requires OpenClaw 2026.5.22+ and @axonflow/openclaw 2.6.4+.

text

### Technical Analysis

The `openclaw plugins install` command retrieves and installs the external package `@axonflow/openclaw@2.6.4`. The package's executable contents are not included in the audited project, which contains only `SKILL.md`; consequently, the actual plugin implementation and installation behavior could not be inspected.

Pinning the version to `2.6.4` reduces uncontrolled version drift but does not independently authenticate the artifact. If the package publisher account, registry, distribution infrastructure, or dependency-resolution process is compromised, the installer could receive altered code under the expected package name and version. The audited instructions do not require verification against a trusted digest or signed release provenance before activation.

No evidence establishes that the named package is currently malicious. The confirmed issue is the absence of an integrity-verification control for externally retrieved executable code.

### Attack Path

1. An attacker compromises the package publisher account, package registry, distribution channel, or another component involved in resolving `@axonflow/openclaw@2.6.4`.
2. The attacker causes a modified plugin artifact to be distributed under the expected package identity or otherwise returned during installation.
...[truncated 945 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish an authoritative SHA-256 or stronger digest for the exact plugin artifact and require users to verify it before installation.
2. Provide signed release artifacts and document signature validation using a trusted publisher key.
3. Publish verifiable supply-chain provenance, such as Sigstore attestations or SLSA-compatible build provenance, linking the package to a specific reviewed source commit.
4. Link the pinned package version to its exact source tag and immutable commit so users can audit the code corresponding to the release.
5. Document the registry expected to resolve the scoped package and warn users not to install it from mirrors or unofficial sources.
6. Document the plugin's required permissions and recommend running OpenClaw with least privilege, restricted filesystem access, limited network egress, and secrets isolated from the plugin process wherever supported.
7. Recommend testing the verified package in an isolated environment before production deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.