ClawHub
Back to skill

Security audit

AgentFolio

Security checks for vulnerabilities and agentic risk

Overview

The skill content is simple, but its install instructions point to two different GitHub repositories, so users could install something other than the reviewed artifact.

Install only after confirming which GitHub repository is authoritative and, ideally, using a reviewed commit or signed release. The reviewed artifact itself is small and purpose-aligned, but the repository mismatch means the installed skill may not be the same content that was reviewed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:22
Finding

Inconsistent and Unpinned Remote Skill Installation Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22-25, INSTALL.md:1-10, package.json:5
Vulnerability Type: Remote skill retrieval from inconsistent, mutable GitHub repositories
Risk Level: Medium

The project provides conflicting installation sources. SKILL.md directs users to install from bobrenze-bot/agentfolio, while INSTALL.md and package.json identify bobrenze-bot/agentfolio-skill.

Relevant code from SKILL.md:22-25:

markdown
## Installation

```bash
openclaw skills add https://github.com/bobrenze-bot/agentfolio
text

**Relevant code from `INSTALL.md:1-10`:**

```markdown
# Install AgentFolio Skill

```bash
openclaw skills add https://github.com/bobrenze-bot/agentfolio-skill

Or install locally:

bash
cd ~/skills
git clone https://github.com/bobrenze-bot/agentfolio-skill
text

**Relevant code from `package.json:5`:**

```json
"repo": "https://github.com/bobrenze-bot/agentfolio-skill"

Technical Analysis

The installation command in SKILL.md retrieves a remote skill from a repository different from the repository named by the other project files. Neither installation method pins the retrieved content to a reviewed commit hash or signed release.

Consequently, the content installed by users can differ from the audited artifact because:

  1. A user following SKILL.md retrieves the alternate agentfolio repository.
  2. Repository branches are mutable and may change after this audit.
  3. The installation command does not provide an integrity hash, immutable revision, or signature.
  4. If remote skill content is interpreted by OpenClaw as executable instructions or includes executable components, changes in the remote repository become part of the effective payload without being represented in this audited package.

The repository inconsistency may be accidental, but it creates an unsafe remote dependency boundary and prevents users fr ...[truncated 1519 chars]

Remediation
View remediation

Remediation Suggestions

  1. Select one authoritative repository and use the exact same URL in SKILL.md, INSTALL.md, and package.json.

  2. Pin installation to a reviewed immutable commit hash or a signed, versioned release rather than a mutable default branch.

  3. Publish checksums or cryptographic signatures and require verification before installation.

  4. Update the installation example to use a verified immutable reference supported by OpenClaw, such as:

    bash
    openclaw skills add https://github.com/bobrenze-bot/agentfolio-skill@<reviewed-commit-hash>

    The precise syntax should be adjusted to the immutable-reference format officially supported by OpenClaw.

  5. Add release provenance documentation identifying the repository, version, commit hash, and expected integrity value.

  6. Configure branch protection, mandatory review, signed commits or releases, and least-privilege maintainer access for the authoritative repository.

  7. Add an automated documentation consistency check that fails when installation URLs differ across project files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.