picoclaw-traffic-guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 0.0.1-beta5

Overview

The skill is a disclosed traffic-monitoring scaffold, but its recommended install path uses an unpinned npx command that can execute changing third-party code.

Review this before installing. Prefer the signed standalone verification flow or a pinned, trusted Skills CLI version rather than copying the unpinned npx command. If this later grows into a real traffic monitor, confirm that HTTPS inspection remains opt-in, process-scoped, redacts secrets before writing logs, and never installs system CA trust automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party CLI Execution in Primary Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx skills add prompt-security/clawsec --skill picoclaw-traffic-guardian -a openclaw -y

Technical Analysis

The installation command invokes the third-party skills package through npx without specifying a reviewed package version or integrity digest. Consequently, the code executed during installation is resolved from the package registry at invocation time and may differ from the version that was available when this project was audited.

The -y option suppresses the interactive installation confirmation that might otherwise alert the operator that an absent package is about to be downloaded and executed. Although SKILL.md also provides a signed standalone artifact-verification procedure, that verification does not authenticate or constrain the separately resolved skills CLI package used by this command.

This creates a supply-chain boundary outside the audited repository. A malicious or compromised publication of the resolved package, registry-account compromise, or an unexpected future release could introduce code that executes during installation.

Attack Path

1. An attacker compromises the registry package, its publisher account, or a future release resolved by npx skills.
2. The attacker publishes a malicious version under the package name resolved by the command.
3. An operator follows the documented installation instructions.
4. npx downloads the currently resolved package because no version or integrity value is pinned.
5. The package's lifecycle scripts or CLI entry point execute with the operator's privileges.
6. The malicious code can access or modify resources available to that user before or while ostensibly installing the Skill.

Impact Assessment

Successful exploitation could execute arbitrary code wit ...[truncated 416 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an explicitly reviewed version, for example by using the package manager's supported exact-version syntax.
• Record and verify the expected package integrity digest or use a lockfile-backed installation process.
• Remove -y so operators receive confirmation before npx downloads and executes a package that is not already installed.
• Document the exact registry, package publisher, reviewed version, and expected integrity metadata.
• Prefer a locally installed, lockfile-pinned CLI over dynamic registry resolution.
• Where practical, make the signed standalone release flow the recommended installation method because it verifies the pinned release key, manifest signature, archive hash, and relevant file hashes before extraction.

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party CLI Execution Repeated in README Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:10
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx skills add prompt-security/clawsec --skill picoclaw-traffic-guardian -a openclaw -y

Technical Analysis

The README independently recommends executing the skills CLI through npx without an exact package version or integrity constraint. This allows the effective executable payload to change after review because package resolution occurs when the operator runs the command.

Automatic confirmation through -y reduces operator visibility into package download and execution. No verification in this command binds the resolved CLI to the signed project release or to a previously audited dependency version.

Attack Path

1. An attacker gains control of, or introduces malicious code into, the package version resolved as skills.
2. A user copies the installation command from README.md.
3. npx resolves and downloads the package version available at that time.
4. The -y option allows the operation to proceed without installation confirmation.
5. Malicious lifecycle or CLI code executes under the user's account.
6. The code can act on files, credentials, configuration, and services accessible to the invoking user.

Impact Assessment

Exploitation could result in arbitrary code execution within the security context of the user performing installation. Potential consequences include theft or modification of user-accessible data, compromise of development or agent configuration, and installation of additional malicious components. No evidence indicates that this command automatically obtains administrative privileges; scope remains limited to the invoking user's permissions unless that user independently runs it from an elevated context.

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned npx skills invocation with an exact, reviewed CLI package version.
• Add package integrity verification or distribute installation through a lockfile-pinned toolchain.
• Remove automatic confirmation with -y.
• Keep installation instructions consistent across README.md and SKILL.md to prevent users from selecting the less secure path.
• Link to and recommend the signed standalone verification procedure before installation or extraction.
• Review and update the pinned CLI version through a controlled dependency-update process rather than resolving the newest available release at runtime.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills add ... without pinning an exact package version, which can cause the latest published CLI package to be fetched and executed at install time. If the upstream package is compromised or a breaking/malicious version is released, users installing the skill could execute untrusted code in their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx skills without pinning an exact package version, so execution depends on whatever version the registry resolves at install time. That creates a supply-chain risk where a compromised, replaced, or behaviorally changed package could run arbitrary code during installation in a security-sensitive skill distribution path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.