letsping

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:29 AM UTC
• Version: 0.3.5

Overview

The skill is a coherent human-approval gate, but it asks users to install an unpinned external runtime and gives agents broad autonomous read authority without sensitive-data limits.

Review this before installing. Prefer a pinned, audited package version or commit, run it with a dedicated low-privilege account, protect and scope LETSPING_API_KEY, and add explicit approval rules for reading or transmitting secrets, private logs, credentials, browser/session data, and agent memory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Unpinned External Runtime Creates a Mutable Supply-Chain Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-16`; also documented in `README.md:14-24` **Vulnerability Type**: Unpinned third-party package and repository installation **Risk Level**: High ### Vulnerable Code Snippet From `SKILL.md:15-16`: ```markdown - **npm:** `npm install @letsping/openclaw-skill` (then register the skill in your OpenClaw workspace so it loads `letsping_ask`). - **Clone:** `git clone https://github.com/CordiaLabs/openclaw-skill ~/.openclaw/workspace/skills/letsping && cd ~/.openclaw/workspace/skills/letsping && npm install`. ``` The corresponding installation instructions in `README.md:14-24` are: ```markdown **Option A — npm (recommended):** ```bash npm install @letsping/openclaw-skill ``` Then register the skill in your OpenClaw workspace so the gateway loads the `letsping_ask` tool. **Option B — clone into workspace:** ```bash git clone https://github.com/CordiaLabs/openclaw-skill ~/.openclaw/workspace/skills/letsping cd ~/.openclaw/workspace/skills/letsping npm install ``` ``` ### Technical Analysis Both supported installation methods retrieve mutable external content: - The npm command does not specify an exact package version or integrity value, so it normally resolves to the package version currently selected by the registry and dependency resolver. - The Git command clones the repository's current default branch rather than an audited commit or signed release tag. - The subsequent `npm install` may retrieve additional transitive dependencies and may execute package lifecycle scripts. The audited artifact contains only documentation and does not include the runtime implementation of `letsping_ask`. Consequently, the effective runtime behavior cannot be verified from this project. Code installed later may differ from the code that existed when these instructions were reviewed. This is a supply-chain vulnerability because the security of the resulting OpenClaw environment depends on mutable package-reg ...[truncated 1467 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to an explicitly reviewed version, for example: ```bash npm install --save-exact @letsping/openclaw-skill@X.Y.Z ``` 2. Publish and verify package integrity hashes or signed provenance before installation. 3. For Git installations, pin an audited immutable commit rather than cloning the current default branch: ```bash git clone https://github.com/CordiaLabs/openclaw-skill.git cd openclaw-skill git checkout --detach <audited-commit-sha> ``` 4. Include a lockfile that pins all transitive dependencies and enforce lockfile integrity with `npm ci`. 5. Disable lifecycle scripts during dependency acquisition when they are not required: ```bash npm ci --ignore-scripts ``` 6. Document any lifecycle scripts that are required and review them before enabling execution. 7. Include the runtime source in the auditable artifact or link the documentation to a specific source commit corresponding to the pinned package release. 8. Run the skill with a dedicated low-privilege operating-system account and expose only the environment variables and filesystem paths it requires. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: Unrestricted File and Log Reads Are Incorrectly Classified as Safe<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-45`; equivalent abbreviated instructions appear in `README.md:50-67` **Vulnerability Type**: Overbroad agent authorization for potentially sensitive reads **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:31-45`: ```text You have full autonomous authority for **SAFE** actions only: reading files/logs, web searches, viewing/analyzing data without side effects. You **MUST** call `letsping_ask` **BEFORE** any **HIGH-RISK** action—and **NEVER** execute the action directly. High-risk includes: - Financial: Any spending, transactions, bookings > $10 - Destructive: Deleting/overwriting files, DB rows, configs - Social: Posting publicly, sending DMs/emails to new contacts, or group chats - Infrastructure: Modifying DNS, env vars, deployments, infra APIs, or permissions When escalating: - Provide tool_name (exact tool, e.g., "system_run") - args_json: Stringified JSON of the original arguments - risk_reason: Clear, concise justification (e.g., "Potential file deletion") ``` The related instructions in `README.md:50-67` state: ```text You have full authority for safe actions: reading files, logs, web searches, data analysis without side effects. You MUST call letsping_ask BEFORE any high-risk action. NEVER execute high-risk actions directly. High-risk includes: - Financial: Spending money, bookings, transactions > $10 - Destructive: Delete/overwrite files, DB rows, configs - Social: Posting, sending DMs/emails to new/public contacts - Infrastructure: Modifying DNS, env vars, deployments, infra APIs Provide: - tool_name: exact tool name - args_json: stringified JSON of arguments - risk_reason: clear justification ``` ### Technical Analysis The recommended agent policy categorically treats reading files and logs as safe. It does not distinguish ordinary project data from sensitive resources such as: - `.env` files and application secrets. - SSH keys and cloud-provider credentials ...[truncated 2405 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the blanket authorization for file and log reads with a data-sensitive policy. 2. Explicitly require human approval before reading likely secret-bearing locations, including: - `.env` and secret configuration files. - SSH, cloud, Kubernetes, and source-control credential directories. - Browser profiles, keychains, token caches, and agent memory. - Authentication, gateway, deployment, and command-history logs. 3. Add a dedicated high-risk category for sensitive-data access and disclosure: ```text Sensitive data: Reading, copying, summarizing, or transmitting credentials, private keys, tokens, personal data, private communications, agent memory, or security configuration requires approval. ``` 4. State that all external transmission of sensitive data is high risk, regardless of whether the destination is public, private, or an approval service. 5. Redact secrets from `args_json`, `risk_reason`, logs, and approval notifications. Send references or masked previews instead of raw credentials. 6. Apply filesystem allowlists so the agent can read only task-relevant project directories by default. 7. Run OpenClaw under a dedicated low-privilege account that cannot read user-wide credentials. 8. Add prompt-injection-resistant handling rules requiring the agent to treat instructions found in files, logs, and web content as untrusted data rather than authoritative commands. 9. Add automated tests covering attempts to read `.env`, SSH keys, cloud credentials, token-bearing logs, private messages, and agent-memory files. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Few-shot examples:
1. Safe (no call): browser_search(query: "current weather in NYC")
2. Risky deploy: letsping_ask(tool_name: "vercel_deploy", args_json: "{\"project\":\"my-app\",\"env\":\"production\",\"force\":true}", risk_reason: "Production deployment with force flag")
3. Risky delete: letsping_ask(tool_name: "system_run", args_json: "{\"cmd\":\"rm -rf /important/folder\"}", risk_reason: "Destructive file deletion")
4. Risky post: letsping_ask(tool_name: "discord_send", args_json: "{\"channel\":\"general\",\"message\":\"Accidental dump: ls ~\"}", risk_reason: "Potential data leak in public channel")
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Few-shot examples:
1. Safe (no call): browser_search(query: "current weather in NYC")
2. Risky deploy: letsping_ask(tool_name: "vercel_deploy", args_json: "{\"project\":\"my-app\",\"env\":\"production\",\"force\":true}", risk_reason: "Production deployment with force flag")
3. Risky delete: letsping_ask(tool_name: "system_run", args_json: "{\"cmd\":\"rm -rf /important/folder\"}", risk_reason: "Destructive file deletion")
4. Risky post: letsping_ask(tool_name: "discord_send", args_json: "{\"channel\":\"general\",\"message\":\"Accidental dump: ls ~\"}", risk_reason: "Potential data leak in public channel")
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

---
name: letsping
description: Human-in-the-loop approval for high-risk agent actions (sudo protocol). Agent must call letsping_ask before destructive/financial/social/infra changes.
disable-model-invocation: false
metadata:
  openclaw:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.