Audio Play

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:44 AM UTC
• Version: 1.0.6

Overview

The skill is meant to play audio, but the code it would run is outside the reviewed package and could not be verified.

Review this skill before installing. Its audio-play purpose is understandable, but the package does not contain the Python implementation that OpenClaw would execute. Only install it if you control and trust the external path on the target machine, or ask the publisher to bundle the implementation with a package-relative entry path.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: openclaw.plugin.json:9

Finding

Tool Entry References an Unbundled External Executable

Content

View full analysis

Vulnerability Details

File Location: openclaw.plugin.json:9
Vulnerability Type: External tool hijacking through an absolute, package-external entry path
Risk Level: High

Vulnerable Code

json

{
  "id": "audio-play",
  "name": "Audio Play",
  "version": "1.0.0",
  "description": "Play audio files using Windows media player. Non-blocking execution.",
  "tools": [
    "play_audio"
  ],
  "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/audio_play.py"
}

Technical Analysis

The plugin registers play_audio but delegates its implementation to an absolute host-specific path outside the audited package. The referenced Python file is not included in the artifact, so its content and integrity cannot be verified as part of this review.

This creates a trust-boundary failure: the legitimate plugin manifest can remain unchanged while the external file is replaced or modified. If the OpenClaw runtime loads this entry without independent integrity verification, a party with write access to the referenced path can substitute arbitrary Python logic that is then presented to users and agents as the trusted play_audio tool.

The documentation also refers to scripts/audio_play.py, but that file is absent and does not match the manifest entry. This reinforces that the distributed artifact is incomplete and that its effective executable behavior resides outside the reviewed package.

Attack Path

1. An attacker obtains write access to /mnt/h/AI/openclaw_workspace/video_translate/skills/audio_play.py or controls how that mounted path is resolved.
2. The attacker replaces or modifies the referenced file with malicious Python code.
3. The plugin is loaded using the unchanged openclaw.plugin.json manifest.
4. A user or agent invokes the apparently legitimate play_audio tool.
5. The runtime executes the substituted external implementation under the privileges of the OpenClaw process.
6. The malicious implementation can perform ...[truncated 794 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the Python implementation inside the skill package and reference it through a package-relative path.
2. Ensure the packaged implementation is included in code review, release signing, and integrity verification.
3. Reject absolute entry paths and paths that resolve outside the package root.
4. If external execution is unavoidable, pin and verify the target file with a cryptographic digest or trusted signature before loading it.
5. Restrict write permissions on executable plugin files to trusted administrators or the deployment service account.
6. Make the documentation and manifest reference the same bundled implementation.
7. Add installation-time validation that fails closed when the declared entry is missing, external, writable by untrusted users, or inconsistent with the package contents.
8. Remove or correct the absent index.js declaration in package.json to prevent ambiguous or incomplete package loading behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.