Openclaw Godmode Skill Repo

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 5.11.3

Overview

This docs-only orchestration skill is transparent, but it gives agents broad runtime authority over code, screenshots, and GitHub operations without enough scoping or confirmation guidance.

Install only if you want an agent to coordinate substantial development work. Use least-privilege GitHub tokens, require human confirmation before PR merges/releases/issue closures, run Playwright only against test or sanitized accounts, review screenshots before sharing or committing them, and pin or locally install MCP packages rather than using unpinned npx/global installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: docs/TROUBLESHOOTING.md:78

Finding

Unpinned Third-Party MCP Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: docs/TROUBLESHOOTING.md, lines 78–90
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

// In your MCP config (mcp.json)
{
  "playwright": {
    "command": "npx",
    "args": ["playwright-mcp"]
  }
}

bash

npm install -g playwright-mcp
npx playwright install

Technical Analysis

The instructions configure npx to execute playwright-mcp without an exact version and recommend installing the package globally. Package resolution therefore depends on mutable npm registry state rather than a reviewed and reproducible dependency version.

If the package is not already installed locally, npx may retrieve executable package content from the registry. A later release, compromised maintainer account, package takeover, or registry compromise could consequently alter the code executed by users after this skill has been reviewed. Global installation also expands the package's availability and potential impact beyond a single isolated project.

This is a supply-chain weakness rather than evidence that the currently referenced package is malicious. The project contains no bundled malicious executable and does not itself perform the installation automatically.

Attack Path

1. An attacker compromises the referenced npm package, its publisher account, or a future package release.
2. Malicious code is published under the same unpinned package name.
3. A user follows the troubleshooting guide or starts the configured MCP server.
4. npm install -g playwright-mcp or npx playwright-mcp resolves the mutable package version from the registry.
5. The downloaded package executes with the privileges and environment of the invoking user.
6. Malicious package code could read accessible project files and environment variables, alter local files, or use the user's network access and configured crede ...[truncated 484 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify and document the official package name, publisher, and source repository before recommending installation.
2. Pin an audited exact version, for example playwright-mcp@X.Y.Z, rather than resolving the latest release.
3. Prefer a project-local development dependency over npm install -g so that execution is isolated to the relevant project.
4. Commit the applicable lockfile and use a reproducible installer such as npm ci.
5. Configure the MCP server to execute the locally installed binary, or use npx --no-install playwright-mcp, preventing implicit registry downloads at runtime.
6. Review package lifecycle scripts and published contents before approval; use --ignore-scripts during installation where compatible.
7. Apply npm integrity and provenance verification and document the expected package checksum or signed release provenance.
8. Run the MCP server with restricted filesystem, environment-variable, credential, and network access consistent with its browser-testing function.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tester agent mandates screenshot capture for every page and viewport, but the specification does not require redaction, test-data isolation, or review for sensitive content. In workflows that exercise authenticated or production-like environments, screenshots can capture PII, secrets, tokens, internal dashboards, or customer data and persist them on disk for later leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The github-manager agent includes ready-to-run gh commands that create, close, merge, release, and inspect CI/CD state, but the spec lacks safeguards such as confirmation requirements, dry-run expectations, scope limitations, or operator consent. In a self-orchestrating skill, this increases the chance of unintended remote state changes to repositories, releases, and workflows if the agent executes commands autonomously or on the wrong target repository.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown instructs users to run rm CLAUDE.md, which is a destructive operation that deletes a project file. Although it notes the step is optional and suggests keeping the file if it has project-specific instructions, it does not clearly warn that the command permanently removes the file and should be used only after confirming a backup or lack of needed content.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

1. Check installed version:

bash

grep "version:" ~/.clawdbot/skills/cc-godmode/SKILL.md

2. Update to latest:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 51)May include surrounding context.

1. Check installed version:

bash

grep "version:" ~/.clawdbot/skills/cc-godmode/SKILL.md

2. Update to latest:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.