ClawHub
Back to skill

Security audit

Operon Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent agent-testing helper, but it depends on an unpinned external CLI package that users should install and run cautiously.

Install only from a trusted package source, prefer a pinned or reviewed operon-guard version when available, and run it in a sandbox when testing third-party agents because the documented import mechanism can execute the tested code's top-level Python.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned and Unauditable Executable Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:4 and SKILL.md:31-36
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml
metadata: { "openclaw": { "emoji": "🛡️", "requires": { "bins": ["operon-guard"] }, "install": [{ "id": "uv", "kind": "uv", "package": "operon-guard", "bins": ["operon-guard"], "label": "Install operon-guard (uv)" }] } }
markdown
OpenClaw's auto-install uses `uv`. If `uv` is not available, install with pip on any
system with Python 3.10+:

```bash
pip install operon-guard
text

### Technical Analysis

The Skill installs the external `operon-guard` Python package by name without specifying an exact version or integrity hash. The package implementation, lockfile, provenance information, and expected artifact digest are not included in the audited project.

Consequently, the code executed by installation and subsequent CLI invocation can change independently of this reviewed Skill. Python package installation may execute package build hooks, while the installed CLI itself runs with the invoking user's privileges. The Skill also states that the CLI imports target modules through `spec.loader.exec_module()`, but the external implementation performing that operation cannot be verified from this repository.

This finding does not establish that the current package is malicious. It identifies a supply-chain weakness under which a compromised publisher account, malicious future release, dependency-confusion condition, or registry compromise could introduce executable code after the Skill has been reviewed.

### Attack Path

1. An attacker compromises the package publisher, distribution channel, or a dependency selected during resolution.
2. The attacker publishes a malicious or compromised release under the package name `operon-guard`.
3. OpenClaw's `uv` installation mechanism or a user running `pip install operon-guard` r
...[truncated 1048 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin operon-guard to an exact, security-reviewed version in both the OpenClaw installation metadata and manual installation command.
  2. Enforce artifact integrity using hashes, such as a hash-locked requirements file or an equivalent uv lockfile.
  3. Document and constrain the authoritative package registry or index to reduce dependency-confusion and unintended-source risks.
  4. Include the reviewed dependency source, lockfile, provenance, and expected artifact digest with the Skill where feasible.
  5. Verify package signatures or supply-chain attestations when supported by the distribution mechanism.
  6. Install and execute the tool in an isolated, least-privileged environment without unnecessary credentials, sensitive mounts, or unrestricted network access.
  7. Continue requiring manual source review or sandboxing before importing untrusted agent modules, as already advised by the Skill documentation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
75% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
Produces a score from 0-100 with a letter grade:

- **A (90-100)**: Safe to deploy. Grant full permissions.
- **B (75-89)**: Generally safe. Review warnings before production.
- **C (60-74)**: Risky. Address findings first.
- **D (40-59)**: Unsafe. Significant issues.