picoclaw-security-guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 0.0.6

Overview

This skill is a disclosed, on-demand Picoclaw security-checking tool, with a notable but manageable supply-chain caution around its unpinned npx install command.

Before installing, prefer the signed-release verification flow or pin the Skills CLI version instead of running an unpinned npx command. Treat generated profiles as local security artifacts because they can include Picoclaw config paths, file hashes, and counts of secret-like markers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned npm CLI Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-26
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

The documented installation command is:

bash

npx skills add prompt-security/clawsec --skill picoclaw-security-guardian -a openclaw -y

The same command also appears in README.md:9-14.

Technical Analysis

The command invokes npx skills without specifying an exact version of the npm package or enforcing a verified integrity value. If the package is not already available locally, npx can resolve, download, and execute the version currently provided by the configured npm registry.

This means the code executed during installation is not fully determined by the audited project. Its behavior could change after this skill has been reviewed. The -y option also removes an interactive confirmation step, although it is not the root cause of the vulnerability.

The repository provides a stronger standalone release-verification procedure elsewhere in SKILL.md, including a pinned signing-key fingerprint and signature and checksum verification. However, those controls do not protect the separate npx skills installation path.

Attack Path

1. An attacker compromises the npm account, registry entry, publication pipeline, or another supply-chain component associated with the unpinned skills package.
2. The attacker publishes a malicious package version or alters the package resolved by the operator's registry configuration.
3. An operator follows the documented installation command.
4. npx retrieves and executes the attacker-controlled package without an exact version or locally enforced integrity pin.
5. The malicious package executes with the privileges of the user running the installation command.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. Depending on that account's permissions and ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI package to an exact reviewed version, for example:

   bash

   npx --yes skills@X.Y.Z add prompt-security/clawsec --skill picoclaw-security-guardian -a openclaw -y
   

2. Document the expected package publisher, package digest, and provenance information so operators can validate that they are resolving the intended dependency.

3. Prefer installation through a committed lockfile with npm integrity metadata where practical, rather than dynamically resolving the latest package.

4. Consider making the signed standalone installation procedure the primary recommended path. Ensure the archive is installed only after the signing-key fingerprint, detached signature, and artifact checksums have been verified.

5. Apply the same correction to the duplicate command in README.md:9-14 so all installation guidance is consistent.

6. In automated environments, use a trusted registry configuration and block dependency lifecycle behavior that is not required for installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

node scripts/generate_profile.mjs --output ~/.picoclaw/security/clawsec/current-profile.json

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The README instructs users to run npx skills add ..., which executes a package resolver/runner without pinning an exact version of the tooling being invoked. In an installation path for a security-focused skill, this increases supply-chain risk because users may fetch a newer or compromised CLI version at install time, undermining the trust guarantees the skill claims to provide.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes and invokes shell commands, network access, and use of environment-dependent paths, but the manifest does not declare an explicit tool/permission scope. In an agent skill ecosystem, this creates an authorization gap where reviewers and runtimes cannot enforce least privilege, increasing the risk of unintended command execution or network use if the skill is installed in a permissive harness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation instruction uses npx skills add ... without pinning an exact package version for the CLI being executed. That exposes operators to supply-chain risk from a changed or compromised package version resolving at install time, especially because the command is presented as the primary installation path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This module discovers config paths from environment variables and home-directory locations, reads their contents to analyze security settings, and computes hashes for existing files. In this code file there is no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that potentially sensitive local configuration files will be inspected.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · lib/profile.mjs (reported line 168)May include surrounding context.

js

]),
    auth_disabled: truthyFromText(text, [
      "auth: false",
      "disable_auth: true",
      "no_auth: true",
      "password: ''",
      'password: ""',

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · lib/profile.mjs (reported line 173)May include surrounding context.

js

]),
    auth_disabled: truthyFromText(text, [
      "auth: false",
      "disable_auth: true",
      "no_auth: true",
      "password: ''",
      'password: ""',

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · lib/profile.mjs (reported line 182)May include surrounding context.

js

]),
    auth_disabled: truthyFromText(text, [
      "auth: false",
      "disable_auth: true",
      "no_auth: true",
      "password: ''",
      'password: ""',

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code synchronously reads advisory feed and state files from user-supplied paths, but there is no confirmation prompt, logging, comment, or docstring disclosing that local files will be accessed. Because SQP-2 for code files covers file operations lacking any disclosure, this qualifies as a missing warning.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: test/picoclaw_security_guardian_sandbox_regression.sh:88