ClawHub
Back to skill

Security audit

KPainter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent KPainter integration for creating and refining explainer media, with no artifact-backed evidence of hidden exfiltration, persistence, destructive behavior, or privilege escalation.

Prefer the OpenClaw/ClawHub install path when available. If using the npx, direct URL, or curl examples, understand that they fetch mutable remote content and should be reviewed or pinned before installation. Connect only a KPainter API key you intend the agent to use for creating and refining KPainter outputs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:279
Finding

Unpinned Third-Party and Mutable Remote Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 279–300
Vulnerability Type: Unpinned third-party dependencies and mutable remote skill content
Risk Level: Medium

Vulnerable code:

markdown
### Skills CLI

```bash
npx skills add OriginwiseAI/skills --skill kpainter

While this repository contains one public skill, this also works:

bash
npx skills add OriginwiseAI/skills

Direct URL

Give the agent:

https://kpainter.ai/skill.md

Local Folder

bash
mkdir -p ~/.codex/skills/kpainter
curl -s https://kpainter.ai/skill.md > ~/.codex/skills/kpainter/SKILL.md
text

### Technical Analysis

The documented installation procedures retrieve dependencies or skill instructions without pinning them to an immutable, audited version.

The `npx skills add` commands do not specify a fixed CLI package version or an immutable repository commit. The direct URL and `curl` installation methods download a mutable `SKILL.md` without checksum verification, signature validation, or an explicit review step.

Although the downloaded Markdown is not piped directly into a shell, installing it into the agent's skill directory causes its instructions to be trusted when the skill is subsequently loaded. Consequently, the effective behavior can change after the reviewed project artifact has been audited. A compromise of the package registry, source repository, publishing account, DNS resolution, or hosting endpoint could substitute malicious content.

### Attack Path

1. An attacker compromises an upstream package, repository, publisher account, or the remote `kpainter.ai` skill-hosting path.
2. The attacker replaces the expected package or `SKILL.md` with altered content.
3. A user follows one of the unpinned installation procedures in `SKILL.md`.
4. The mutable content is retrieved and installed without integrity or authenticity verification.
5. The agent later loads the subst
...[truncated 805 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the Skills CLI package to a reviewed, exact version rather than relying on the version selected by npx.
  2. Pin the skill repository to an immutable commit hash or signed release tag.
  3. Publish a cryptographic checksum or signature for every released SKILL.md.
  4. Download remote content to a temporary file and verify its checksum or signature before placing it in the agent's skill directory.
  5. Use failure-aware download options such as curl --fail --show-error --location so HTTP errors are not silently written as skill content.
  6. Avoid overwriting an existing trusted skill until verification succeeds; use an atomic replacement after validation.
  7. Prefer distributing the audited skill artifact with the project instead of directing users to a mutable remote URL.
  8. Document the expected release version, commit identifier, checksum, and verification procedure beside every installation command.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
3. Ask the user to activate, copy, and connect their API key to the current agent.
4. Confirm setup only after the user says the key is connected.

Keep the key inside the current agent connection flow. Never ask the user to send it to unrelated services.

## Products And Public API Types

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
- aspect ratio
- source files or URLs

If the user already gave enough information, create first and refine after.

## Use Source Material

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

Local Folder

bash
mkdir -p ~/.codex/skills/kpainter
curl -s https://kpainter.ai/skill.md > ~/.codex/skills/kpainter/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

bash
mkdir -p ~/.codex/skills/kpainter
curl -s https://kpainter.ai/skill.md > ~/.codex/skills/kpainter/SKILL.md

Security

Static analysis

No suspicious patterns detected.