nanoclaw-traffic-guardian

• Outcome: Pass
• Latest audit: Sep 7, 2026 · 2:36 PM UTC
• Version: 0.0.2

Overview

This is a disclosed specification scaffold for traffic monitoring, with sensitive future capabilities bounded by opt-in, redaction, and host-side controls.

Before installing, prefer the signed release verification workflow over the short npx command, or pin the installer and source to reviewed versions. Treat future implementations carefully because this skill is intended to inspect traffic and detect secrets, but the current reviewed artifact is only a specification scaffold and does not ship an active proxy or runtime monitor.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21
• Finding: Unpinned Vercel Skills CLI Executes Mutable Installation-Time Dependencies## Vulnerability Details **File Location**: `SKILL.md`, line 21 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw -y ``` ### Technical Analysis The installation command invokes the `skills` npm package through `npx` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` can retrieve and execute the currently resolved package version. The `-y` option automatically accepts installation prompts. This means the code executed during installation is not limited to the artifact reviewed in this audit. A compromised npm package, malicious newly published version, or supply-chain incident affecting the resolved CLI package could alter the installation behavior after this skill has been reviewed. The `prompt-security/clawsec` source is also not pinned to an immutable commit or signed release identifier in this command. The signed standalone verification procedure at `SKILL.md:25-100` reduces risk for users who follow that alternative process, but it does not establish the integrity of the separate `npx` installation path. ### Attack Path 1. An attacker compromises the publishing account, distribution channel, or dependency chain for the unpinned `skills` npm package, or causes a malicious version to be resolved. 2. The attacker publishes installation-time code under the package version selected by `npx`. 3. An operator follows the documented installation command. 4. `npx` downloads the mutable package version and, because `-y` is supplied, proceeds without an interactive installation confirmation. 5. The attacker-controlled CLI code executes with the privileges of the operator running the command. 6. That code can modify user-accessible files, read credentials available to the process, initiate network connections, or ...[truncated 569 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a reviewed exact version, for example `npx skills@<reviewed-version> ...`, rather than resolving the latest available release. 2. Pin the skill source to an immutable commit digest or signed release tag supported by the installer. 3. Verify package and artifact integrity using a trusted checksum or signature before execution. 4. Prefer the signed standalone release-verification procedure already documented in `SKILL.md`, ensuring verification succeeds before extraction or installation. 5. Remove `-y` where practical so operators receive confirmation before an absent package is downloaded and executed. 6. Execute installation in a least-privileged, isolated environment without unnecessary credentials or sensitive environment variables. 7. Document the exact reviewed CLI version and update it only after security review.

T08 · Insecure Dependencies

Warning

• Location: README.md:12
• Finding: README Recommends Unpinned Remote CLI Execution## Vulnerability Details **File Location**: `README.md`, line 12 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw -y ``` ### Technical Analysis The README presents an installation path that executes the unversioned `skills` npm package through `npx`. The effective executable can therefore change independently of this audited project. The automatic confirmation flag `-y` further removes the normal opportunity for an operator to notice that a package must be downloaded. Unlike the standalone workflow in `SKILL.md:25-100`, this README command does not verify a pinned signing-key fingerprint, signed manifest, archive hash, or file checksums before invoking the installer. It also references `prompt-security/clawsec` without an immutable commit identifier in the documented command. ### Attack Path 1. An attacker gains control over a package version or dependency selected when `npx` resolves `skills`. 2. The attacker introduces malicious installation or runtime behavior into the resolved package. 3. A user copies the command from `README.md`. 4. `npx` retrieves and executes the attacker-controlled package with the user's existing privileges. 5. The malicious process can access resources available to the user and may install substituted skill content. 6. Because no signature or checksum verification is performed by the documented command itself, the user may not detect the substitution before execution. ### Impact Assessment The maximum direct privilege is that of the invoking account. Potentially exposed resources include user files, environment variables, developer credentials, package-manager credentials, SSH configuration, and reachable network services. Execution in CI, developer workstations, or administrative shells may broaden the affected scope. No evidence shows tha ...[truncated 140 chars]
• Remediation: ## Remediation Suggestions 1. Replace the unversioned invocation with an exact, reviewed CLI version. 2. Reference an immutable skill release or commit instead of a mutable repository state. 3. Add the signed artifact verification workflow to the README or link prominently to the complete procedure in `SKILL.md`. 4. Require successful signature and checksum validation before installation. 5. Avoid automatic confirmation with `-y`, especially when the CLI is not already installed and verified. 6. Recommend installation from a minimally privileged account or isolated build environment. 7. Keep README and SKILL installation instructions synchronized so the shorter documentation does not bypass the stronger verification process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Static analysis

No suspicious patterns detected.