Postwall

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:35 PM UTC
• Version: 1.7.0

Overview

This email approval skill is coherent, but it relies on an unpinned external npm CLI that will handle an API key and email data.

Review this before installing if you are comfortable granting a third-party CLI access to a PostWall API key and approved email content. Prefer a pinned or otherwise verified CLI release, keep the API key scoped and rotatable, and enable polling only when you actually want the agent checking email during the session.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Unpinned npm package dependency
Risk Level: Medium

Vulnerable Code

json

metadata: {"version":"1.7.0","author":"postwallapp","license":"MIT","homepage":"https://postwallapp.com","repository":"https://github.com/postwallapp/postwall","openclaw":{"requires":{"bins":["postwall"],"env":["POSTWALL_API_KEY"]},"primaryEnv":"POSTWALL_API_KEY","install":[{"id":"npm","kind":"node","package":"postwall","bins":["postwall"],"label":"Install PostWall CLI (npm)"}]}}

Technical Analysis

The installation metadata directs the environment to install the mutable npm package postwall without an exact version or integrity digest. Although the skill metadata itself declares version 1.7.0, that value does not constrain the version resolved by npm.

Because the CLI implementation is not included in the audited project, its behavior could not be verified. Installation may execute npm lifecycle scripts, and subsequent CLI operations expose the installed package to the POSTWALL_API_KEY and sensitive email data. A compromised or unexpectedly changed package release could therefore introduce arbitrary local code under the identity running the skill.

Attack Path

1. An attacker compromises the package publisher account, registry artifact, or another part of the package release process.
2. The attacker publishes a malicious version under the mutable postwall package name.
3. A user installs the skill, and dependency resolution retrieves that malicious release because no exact version or integrity hash is required.
4. Malicious code executes through an installation lifecycle script or when the postwall binary is invoked.
5. The package reads the available POSTWALL_API_KEY, CLI arguments, configuration, or email and draft content and then exfiltrates data or performs arbitrary actions with the process user's privileges.

Impact Assessm

...[truncated 572 chars]

Remediation

View remediation

Remediation Suggestions

• Pin postwall to a reviewed, exact package version rather than resolving the latest compatible release.
• Require and verify a cryptographic integrity digest for the expected package artifact.
• Commit and enforce a lockfile where the installation framework supports one.
• Disable npm lifecycle scripts during installation where operationally practical, or explicitly review every lifecycle script in the complete dependency tree.
• Publish auditable CLI source and reproducible-build information corresponding to the pinned artifact.
• Generate a software bill of materials and continuously scan direct and transitive dependencies.
• Run the CLI in a sandbox with minimum filesystem and network privileges.
• Scope the API key to only the operations required by this skill, protect its local configuration with restrictive file permissions, and support rapid credential rotation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill explicitly instructs the agent to poll for new email every 5–10 minutes, which creates ongoing network activity and routine transmission of email-related metadata to a third-party service. While this is central to the product’s purpose and not overtly malicious, the documentation does not warn users that enabling this workflow may result in continuous background access patterns and privacy-relevant metadata exposure during active sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.