ORF

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This skill mostly does the advertised ORF news digest, but it needs review because it automatically installs live Python packages and uses a local Gemini/OpenClaw API key for external image generation.

Review before installing. This skill contacts ORF and a Google/Gemini image-generation service, relies on a Gemini API key from the environment or OpenClaw config, and downloads unpinned Python packages when first run. Install it only if you are comfortable with that external service use and supply-chain behavior, preferably after pinning dependencies and documenting the credential and network requirements.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_zib_nano_banana.sh:10

Finding

Runtime Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_zib_nano_banana.sh, lines 10–12
Vulnerability Type: Unpinned runtime dependencies
Risk Level: Medium

Vulnerable Code:

sh

if [ ! -x "$PY" ]; then
  python3 -m venv "$VENV_DIR"
  "$PY" -m pip install --quiet --disable-pip-version-check google-genai pillow
fi

Technical Analysis

The script automatically installs google-genai and pillow from the configured Python package index during normal execution. Neither package has a pinned version or an integrity hash. Therefore, the code ultimately executed by the Skill is mutable and cannot be fully established from the reviewed project files.

If an upstream package, transitive dependency, or configured package index is compromised, malicious package code may execute during installation or subsequent import. The risk is amplified because installation occurs automatically whenever ./tmp/orf-venv/bin/python is absent.

This finding does not establish that the current packages are malicious; it identifies an avoidable supply-chain exposure caused by unconstrained runtime dependency resolution.

Attack Path

1. An attacker compromises a relevant package release, transitive dependency, or package-index resolution path.
2. The local virtual environment is absent, deleted, or otherwise lacks an executable Python binary.
3. A user invokes generate_zib_nano_banana.sh.
4. pip resolves and downloads the latest packages available under the unpinned names.
5. Malicious package installation or import-time code executes with the privileges of the Agent process.
6. That code can access resources available to the process, potentially including local files, environment variables, configuration files, network access, and API credentials.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution under the operating-system identity running the Skill. The r ...[truncated 323 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Generate a lock file that also constrains transitive dependencies.
• Require package hashes, such as with pip install --require-hashes.
• Install dependencies during a controlled deployment or setup phase rather than automatically during ordinary Skill execution.
• Use a trusted, access-controlled package index or vetted internal mirror.
• Run dependency vulnerability and provenance checks in CI.
• Execute the Skill with least privilege and restrict access to unrelated files, credentials, and network destinations.
• Fail safely with clear setup instructions when dependencies are unavailable instead of downloading mutable code automatically.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no permissions while its documented procedure invokes local scripts, reads files, performs network access to ORF, and likely accesses environment/config for downstream image generation. This creates a trust and sandboxing gap: operators may approve or run the skill under false assumptions, and hidden capabilities can expose secrets or enable unintended external communication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior does not accurately reflect what the skill actually does, including use of an external image-generation service and credential-dependent execution. Behavioral mismatches are dangerous because they defeat informed consent and security review, and can cause data to be sent to third parties or capabilities to be exercised that users and administrators did not authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script accepts a caller-controlled output path, expands and resolves it, creates parent directories, and writes the generated image there without constraining the destination to a safe workspace. In an agent setting, this can be abused to overwrite or plant files in unintended locations accessible to the process, which exceeds the narrow news-digest purpose and increases the risk of filesystem misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.