Amplifier

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:11 PM UTC
• Version: 1.1.1

Overview

This looks like a real Amplifier delegation skill, but it under-discloses external delegation, persistent sessions, and remote executable installation risks.

Review before installing. Use this only if you are comfortable with an external multi-agent CLI receiving task prompts and possibly project context. Avoid sensitive repositories unless you have verified the tool's data handling and session deletion behavior, and prefer an install pinned to a reviewed commit or verified release artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Executable dependency installed from a mutable Git reference without integrity verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15 and SKILL.md:137
Vulnerability Type: Unverified third-party VCS dependency
Risk Level: Medium

Vulnerable Code

Installation metadata at SKILL.md:15:

json

"package": "amplifier-app-openclaw @ git+https://github.com/microsoft/amplifier-app-openclaw@v1.0.5",

Manual installation command at SKILL.md:137:

bash

uv tool install "amplifier-app-openclaw @ git+https://github.com/microsoft/amplifier-app-openclaw@v1.0.5"

Technical Analysis

The Skill directs uv to fetch and install executable Python package code directly from a remote Git repository. The dependency is pinned to the tag v1.0.5, but a Git tag is not necessarily immutable and can potentially be deleted or retargeted. The installation process does not verify an immutable commit SHA, artifact hash, or cryptographic signature.

The package's source code, build configuration, and transitive dependencies are not included in the audited project. Package installation may execute build-system code, and the installed command will subsequently execute the downloaded application code. Consequently, the effective code executed by users can differ from the code that was originally reviewed.

No evidence establishes that the referenced package is currently malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the same audited content.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, release credentials, or another relevant dependency source.
2. The attacker replaces or retargets the v1.0.5 tag, or compromises a transitive dependency resolved during installation.
3. A user installs the Skill dependency through its declared installation metadata or the documented uv tool install command.
4. uv downloads the attacker-controlled source or dependency content.
5. Malicious code executes during package building, installation, or later ...[truncated 919 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable tag with a reviewed, immutable full commit SHA.
2. Prefer a trusted release artifact with published cryptographic hashes or signatures, and verify those values before installation.
3. Lock all transitive dependencies to reviewed versions and enforce hash verification where supported.
4. Record the expected upstream repository identity and reviewed commit in the Skill documentation.
5. Perform installation only after explicit user approval, clearly disclosing that remote executable code and transitive dependencies will be downloaded.
6. Run installation and delegated workloads in a sandbox or least-privileged environment without unnecessary credentials or sensitive filesystem access.
7. Periodically audit the pinned source and dependency lock before updating either.
8. Consider distributing a reproducibly built, signed package through a trusted package registry rather than installing directly from a VCS URL.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to send user prompts to an external multi-agent CLI and encourages delegating complex tasks, but it does not warn that prompts, code, and surrounding project context may be transmitted to or processed by an external tool/service. In a coding assistant context, this can cause unintentional disclosure of sensitive source code, credentials, internal architecture, or proprietary user data during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented session persistence feature encourages named sessions and resume behavior without warning that task history, prompts, and project-derived context may be retained across runs. This creates a risk of longer-lived storage and unintended resurfacing of sensitive data, especially in multi-step code or research workflows where users may assume each run is isolated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.