openclaw-traffic-guardian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 0.0.1-beta5

Overview

This is a coherent security-monitoring specification scaffold with no shipped runtime code, though users should avoid the documented unpinned auto-confirming install command unless they trust the resolved CLI.

Before installing, prefer a pinned and reviewed Skills CLI version or the signed standalone release-verification path. If this is later implemented, confirm that monitoring remains opt-in, process-scoped, redacts secrets before logging, and never installs system-wide CA trust or blocks/mutates traffic without explicit operator action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party CLI Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add prompt-security/clawsec --skill openclaw-traffic-guardian -a openclaw -y

Technical Analysis

The recommended installation command invokes the generic skills npm package through npx without specifying an exact package version or verifying its integrity. If the package is not already available locally, npx may retrieve its currently resolved version from the configured npm registry and execute it immediately.

Because the dependency is unpinned, the code executed by this command may change after this Skill has been reviewed. The -y option also suppresses the normal installation confirmation. The signed-release verification procedure elsewhere in SKILL.md authenticates separately downloaded release artifacts, but it does not authenticate the npm CLI executed by this command.

This creates a supply-chain trust gap rather than evidence that the current package is malicious.

Attack Path

1. An attacker compromises the npm account, package publication process, registry response, or a transitive dependency associated with the resolved skills package.
2. The attacker publishes or causes resolution of a modified package version containing malicious lifecycle or CLI code.
3. An operator follows the documented installation command.
4. npx downloads the unpinned package and executes it with confirmation automatically accepted by -y.
5. The malicious code runs with the privileges and environment access of the operator who initiated installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, the malicious package could read accessible credentials and files, alter local configurat ...[truncated 260 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, for example:

  bash

  npx skills@<reviewed-exact-version> add prompt-security/clawsec \
    --skill openclaw-traffic-guardian \
    -a openclaw
  

• Remove -y so operators can review the package installation prompt.

• Prefer an installation mechanism backed by a lockfile and npm integrity metadata.

• Document how operators can verify the resolved CLI package name, version, publisher, and integrity before execution.

• Prefer the existing signed-release workflow for security-sensitive or standalone installations.

• Ensure that CI periodically audits the pinned CLI and its transitive dependency tree before updating the documented version.

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned Third-Party CLI Installation Is Repeated in the README

Content

View full analysis

Vulnerability Details

File Location: README.md, line 12
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add prompt-security/clawsec --skill openclaw-traffic-guardian -a openclaw -y

Technical Analysis

The README independently recommends executing the unversioned skills npm package through npx. This allows the effective installer code to change without a corresponding change to the audited repository. The command also uses -y, suppressing the installation confirmation.

Unlike SKILL.md, the README does not place signed-artifact verification instructions next to this command. Operators relying only on the README may therefore execute the remotely resolved CLI without being informed of the available authenticated standalone-installation path.

Attack Path

1. An attacker compromises or substitutes the npm package version resolved for skills, or compromises one of its executable dependencies.
2. An operator copies the installation command from README.md.
3. npx retrieves the current unpinned package from the configured registry.
4. The -y option suppresses confirmation, and the downloaded CLI executes.
5. Attacker-controlled code gains the same local access as the invoking operator.

Impact Assessment

Exploitation could result in arbitrary code execution in the operator's security context. Accessible project files, local configuration, environment variables, credentials, and developer tooling could be read or modified. Network access available to the user could also be abused.

No evidence was found that the present scaffold performs these actions; the risk arises from executing a mutable, unauthenticated dependency during installation.

Remediation

View remediation

Remediation Suggestions

• Replace the command with an exact, reviewed CLI version and omit automatic confirmation:

  bash

  npx skills@<reviewed-exact-version> add prompt-security/clawsec \
    --skill openclaw-traffic-guardian \
    -a openclaw
  

• Add a direct reference to the signed release-manifest verification procedure.

• Keep installation guidance synchronized between README.md and SKILL.md.

• Where supported, require package integrity verification or install the CLI from a locked dependency set before invoking it.

• Review every version update and its transitive dependencies before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx skills without pinning an exact package version or immutable source, so the fetched CLI could change over time or be replaced upstream. Because this is an install path for a security-sensitive skill, a compromised or typosquatted package could execute arbitrary code during installation before any of the later artifact-verification guidance is applied.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SPEC.md (reported line 99)May include surrounding context.

md

- Maximum scan bytes must be configurable and bounded.
- CA trust must be per-process by default.
- System trust-store instructions must require explicit operator confirmation and must never run automatically.
- POLICY_REVIEW findings must create an operator-review record only; they must not auto-block, auto-approve, or rewrite the requested action.

## Tests Required Before Release

Static analysis

No suspicious patterns detected.