MARL — Multi-stage Reasoning Middleware

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:03 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent LLM middleware integration, but it asks users to route all model traffic through an opaque, unpinned third-party executable while making an overbroad privacy claim.

Install only if you are comfortable sending all configured LLM traffic through MARL and then to the selected backend provider. Prefer a pinned image digest or exact package version, run it with minimal privileges and no unnecessary secrets or mounts, and treat the privacy claim as applying only to fully local model deployments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned and Unauditable Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41, SKILL.md:47-48, and SKILL.md:157
Vulnerability Type: Supply-chain exposure through mutable, opaque dependencies
Risk Level: Medium

Vulnerable Code

bash

docker run -p 8080:8080 vidraft/marl

bash

pip install marl-middleware
python -m marl serve --port 8080

text

MARL's core engine is delivered as compiled binaries to protect proprietary technology.

Technical Analysis

The installation instructions download and execute either the mutable vidraft/marl container image or the unpinned marl-middleware PyPI package. Neither installation method specifies an immutable container digest, an exact package version, nor an integrity hash.

Consequently, the artifact installed by a user can differ from the artifact originally reviewed. The risk is compounded by the statement that the core engine is distributed as compiled binaries and is absent from this project, preventing source-level verification of its behavior.

The documented configuration places this middleware in the complete LLM request path. After installation, OpenClaw sends its LLM prompts and related request data to the service on port 8080. This gives the externally supplied component access to potentially sensitive prompts, generated responses, and any authentication or request metadata forwarded by the client.

This finding does not establish that the current upstream package or image is malicious. It identifies an unsafe dependency acquisition and execution process whose security depends entirely on mutable, unaudited upstream artifacts.

Attack Path

1. A user follows SKILL.md and runs the unpinned docker run or pip install command.
2. Docker Hub, PyPI, the publisher account, or the associated release pipeline is compromised, or a later release introduces malicious behavior.
3. Because no version, digest, or hash is pinned, the user's installation r ...[truncated 1184 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Python dependency to a reviewed exact version rather than installing the latest release.
2. Require package hashes using a locked dependency file and hash verification, such as pip install --require-hashes.
3. Pin the container image by immutable digest, for example vidraft/marl@sha256:..., after independently verifying the digest.
4. Publish an SBOM, signed release attestations, checksums, and reproducible build instructions for every distributed artifact.
5. Make the middleware source available for audit or arrange an independent review of the compiled core.
6. Run the service as a dedicated non-root user with a read-only filesystem, dropped Linux capabilities, resource limits, and no unnecessary host mounts.
7. Restrict outbound network connectivity to explicitly required destinations and document precisely which prompt data or credentials may be forwarded.
8. Avoid supplying unnecessary secrets through environment variables or mounted configuration files.
9. Bind the service only to the interface required by the integration and enforce authentication if it can be reached by other users or systems.
10. Document a release verification and update process so users can confirm provenance before replacing an audited dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The Docker command pulls and runs vidraft/marl without a pinned tag or image digest, so users may receive different image contents over time, including potentially compromised or unreviewed updates. In a security-sensitive middleware component that intercepts all LLM traffic, this weakens supply-chain integrity and makes deployments non-reproducible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description tells users to point their baseURL at the middleware but does not prominently warn that all LLM requests will transit through MARL before being sent onward to another configured model provider. This reduces informed consent and can lead users to route confidential or regulated inputs through an additional processing layer they did not fully understand.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation states that data never leaves the user's infrastructure, but elsewhere explicitly says MARL forwards requests to a chosen LLM provider such as OpenAI, Anthropic, Google, or other external endpoints. This is a misleading data-flow claim that can cause operators to expose sensitive prompts, documents, or regulated data under false assumptions about locality and privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.