picoclaw-self-pen-testing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 0.0.5

Overview

This skill is a narrowly scoped local posture-review tool, with one installation hygiene caution around an unpinned npx command.

Before installing, prefer the signed release verification instructions or a pinned, reviewed installer version instead of the floating npx command. Once installed, expect the tool to read the Picoclaw profile file you provide and print security findings; do not treat its recommendations as automatic remediation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party CLI Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–26
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add prompt-security/clawsec --skill picoclaw-self-pen-testing -a openclaw -y

The same command also appears in README.md, lines 11–12.

Technical Analysis

The documented installation procedure invokes npx skills without specifying an exact package version. If the package is not already available locally, npx can download and execute the version currently resolved from the configured npm registry. Consequently, the code executed by this command can differ from the code reviewed during this audit.

The -y option suppresses interactive confirmation. It therefore reduces the opportunity for the operator to inspect the resolved package and installation operation before execution. The command also directs the CLI to obtain and install remote repository content.

The project provides a separate signed-release verification procedure in SKILL.md, lines 29–106. That procedure pins the release public-key fingerprint and verifies the manifest signature and artifact hashes. However, the primary installation command shown above does not require that verification procedure to complete before the third-party CLI runs.

No evidence was found that the currently referenced package or repository is malicious. The vulnerability is the mutable and unpinned trust relationship in the documented installation path.

Attack Path

1. An attacker compromises the npm package represented by the skills command, its publisher account, or a relevant package-resolution source.
2. The attacker publishes a modified version containing malicious CLI or lifecycle behavior.
3. An operator follows the documented installation command.
4. npx resolves and downloads the attacker-controlled package version because no exact version is pinned.
5. The downloaded pack ...[truncated 856 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating npx skills invocation with an exact, reviewed CLI version, for example by specifying an immutable version rather than allowing latest-version resolution.
2. Lock and verify the CLI package integrity through a lockfile, registry integrity metadata, or a separately validated package hash.
3. Remove -y from security-sensitive installation guidance so the operator can inspect and approve the resolved package and operation.
4. Make signed artifact verification a mandatory prerequisite rather than an optional standalone-install path.
5. Prefer downloading the release archive, signed manifest, signature, and pinned public key first; verify the public-key fingerprint, signature, and every required artifact hash before installation or extraction.
6. Advise operators not to run the installer with administrator or root privileges.
7. Document the exact trusted registry and package identity to reduce package-resolution ambiguity.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add ... without pinning an exact package version. This can cause installation of a newer or compromised package at execution time, creating a supply-chain risk if the registry package changes or is hijacked. Because this is an installation command presented for operator use, the context makes the issue more dangerous rather than less.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · lib/self_pen_test.mjs (reported line 6)May include surrounding context.

js

const findings=[]; const rt=profile?.posture?.runtime || {};
  if (rt.ui?.public_web_ui) add(findings,"critical","PUBLIC_WEB_UI_EXPOSED","Web UI appears bound publicly","public_web_ui=true or equivalent detected","Bind to localhost or enforce password auth + CIDR allowlist before exposure.");
  if (rt.ui?.auth_disabled) add(findings,"critical","WEB_UI_AUTH_DISABLED","Web UI auth appears disabled","auth_disabled=true or empty password marker detected","Require password/session auth for any gateway controller UI.");
  if (rt.tools?.unrestricted_workspace) add(findings,"critical","WORKSPACE_UNRESTRICTED","Tool workspace restriction appears disabled","restrict_to_workspace=false or sandbox=false marker detected","Enable workspace confinement and deny symlink/absolute-path escapes.");
  if (rt.risky_toggles?.allow_unsigned_mode) add(findings,"critical","UNSIGNED_MODE_ALLOWED","Unsigned or insecure verification mode appears enabled","allow_unsigned/skip_signature marker detected","Disable unsigned mode except short audited break-glass windows.");
  if (rt.mcp?.enabled) add(findings,"high","MCP_REVIEW_REQUIRED","MCP servers enabled","mcp marker detected","Review each MCP server as a separate trust boundary with least privilege and secrets isolation.");
  if (rt.tools?.enabled) add(findings,"medium","TOOLING_REVIEW_REQUIRED","Agent tools appear enabled","tools/code_execution/shell/filesystem marker detected","Require per-tool allowlists and operator approval for dangerous tools.");

Static analysis

No suspicious patterns detected.