nanoclaw-traffic-guardian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 0.0.2

Overview

This is a disclosed specification-only security monitoring skill with no active runtime code, but users should prefer the verified release path or a pinned installer.

Before installing, prefer the signed release verification workflow or use a pinned, trusted version of the Skills CLI. Future implementations should be reviewed carefully because traffic proxying and optional HTTPS inspection can expose sensitive request data, even though this scaffold explicitly requires opt-in operation, redaction, and host-side key handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Package Execution in Documented Installation Command

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:20
• README.md:10

Vulnerability Type: Unpinned third-party package execution and supply-chain exposure
Risk Level: Medium

Vulnerable Code:

bash

npx skills add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw -y

Technical Analysis

The documented installation command invokes the skills package through npx without specifying an exact audited version or package integrity value. If the package is not already available locally, npx may retrieve and execute the version currently resolved by the configured npm registry.

Consequently, the code executed at installation time can differ from the code reviewed when these instructions were published. The command also uses the non-interactive -y option, reducing the opportunity for the operator to review installation actions. Although SKILL.md separately provides signed-manifest verification for standalone release artifacts, that verification procedure is not applied to this CLI installation path.

This is a supply-chain weakness rather than evidence that the current skills package is malicious.

Attack Path

1. An attacker compromises the npm package, its publisher account, the configured package registry, or another relevant distribution path.
2. The attacker publishes or serves a malicious version under the package name resolved by npx skills.
3. An operator follows the documented installation command.
4. npx downloads the currently resolved package because no exact version or integrity constraint is specified.
5. The malicious package executes with the privileges of the user running the installation command.
6. The package can modify files, access data available to that user, make network requests, or install altered Skill content.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing ...[truncated 522 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer CLI to an exact audited version, for example:

   bash

   npx --yes skills@EXACT_AUDITED_VERSION add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw
   

2. Publish and document the expected npm package publisher, package version, and integrity digest.

3. Prefer a lockfile-backed installation or a verified local installation of the CLI instead of downloading executable package code at invocation time.

4. Pin the Skill source to an immutable release tag or commit where supported.

5. Extend the signed release-manifest verification process to the CLI installation path, or instruct users to download and verify the release artifacts before installation.

6. Avoid non-interactive confirmation flags for security-sensitive installation steps unless the resolved package version and artifact integrity have already been verified.

7. Apply the corrected command consistently in both SKILL.md and README.md.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The installation command uses npx skills without pinning a specific package version, so execution depends on whatever version is currently resolved from the registry. That creates a supply-chain risk: a compromised, malicious, or breaking newer release could execute arbitrary code during install in the user's environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.