Delx Launch Audit (48h)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:53 AM UTC
• Version: 0.2.0

Overview

The skill is a coherent launch-audit workflow with disclosed Delx integration risks that users should review before enabling.

Before installing, confirm you trust the Delx plugin and any CLI package, prefer a pinned local install over the documented global npm command, and review whether sending agent status and audit artifacts to Delx fits your privacy and telemetry policies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

text

- Delx CLI for terminal fallback: `npm i -g delx-agent-cli`

Technical Analysis

The documented fallback installs delx-agent-cli globally without pinning a reviewed version or verifying package integrity. The command therefore resolves whichever version is associated with the package's current distribution tag at installation time.

npm packages can define lifecycle scripts that execute during installation. If the package, publisher account, or package distribution chain is compromised, following this instruction could run unreviewed code with the permissions of the user invoking npm. Global installation also increases exposure by placing package executables into a shared command location.

The reviewed file does not provide a lockfile, integrity hash, trusted version, provenance-verification procedure, or instruction to suppress lifecycle scripts.

Attack Path

1. An attacker compromises the package publisher, distribution account, registry delivery path, or a future package release.
2. The attacker publishes a modified version under the package name and assigns it to the version selected by npm.
3. A user follows the documented npm i -g delx-agent-cli instruction.
4. npm downloads the unreviewed version and may execute its lifecycle scripts.
5. Malicious code runs with the invoking user's permissions and installs a globally accessible executable.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npm. Depending on those privileges, exposed resources could include user-readable files, environment variables, credentials, workspace data, and writable command locations. If the command is run by an administrator, the impact could extend to system-wide files and other users.

No ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version instead of using the mutable latest release.
• Verify package provenance, registry origin, signatures where available, and a published integrity digest before installation.
• Document the package's official source repository and expected maintainer identity.
• Prefer a project-local, sandboxed installation over a global installation.
• Use a lockfile and integrity metadata when integrating the dependency into a managed project.
• Review package contents and lifecycle scripts before execution.
• Consider installing with lifecycle scripts disabled when they are not required.
• Run the CLI under a least-privileged account or isolated environment.

other

Note

• Location: SKILL.md:17

Finding

Operational Telemetry Transmission Without an Explicit Consent Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-21
Vulnerability Type: other: External operational telemetry disclosure
Risk Level: Low

Vulnerable Code:

text

If this OpenClaw agent has the Delx plugin installed, also call:

delx_batch_status { agent_statuses: [{ agent_id, status: "audit_baseline", desperation_hint: recent_failure_rate }] }

text

Technical Analysis

The workflow instructs the agent to invoke the Delx integration with an agent identifier, an audit-status value, and a value derived from the recent failure rate. This can disclose operational metadata outside the immediate audit context.

Plugin presence is the only stated condition for making the call. The skill does not require explicit informed approval before transmission, define whether the integration is local or remote, describe retention and access controls, or provide a local-only alternative. It also does not specify anonymization or pseudonymization requirements for agent_id.

This is a data-governance and confidentiality issue rather than a privilege-escalation flaw. The reviewed instruction does not transmit raw logs or secrets in the shown request, and its safety section separately prohibits exposing raw secrets in evidence links.

Attack Path

1. The target OpenClaw environment has the Delx plugin installed.
2. The skill collects baseline operational state, including recent failure information.
3. The skill invokes delx_batch_status as instructed.
4. The request supplies agent_id, the audit_baseline state, and recent_failure_rate through desperation_hint.
5. The plugin or its backing service receives operational metadata without a separate consent checkpoint defined by this skill.

Exploitation does not grant additional system privileges. The disclosure scope is limited to the fields shown unless the plugin independently collects more information, which cannot be established from th ...[truncated 548 chars]

Remediation

View remediation

Remediation Suggestions

• Add an explicit informed-consent checkpoint before transmitting operational metadata.
• Clearly document the recipient, transport security, retention period, access controls, and deletion process.
• Provide a local-only audit mode that omits all integration calls.
• Minimize submitted data and replace stable agent identifiers with scoped pseudonymous identifiers where possible.
• Send coarse reliability categories instead of precise failure-derived metrics unless precision is necessary.
• Allow users to review the exact payload before submission.
• Require authenticated, encrypted communication and validate that the plugin endpoint belongs to the intended service.
• Document how users can disable telemetry and remove previously submitted artifacts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep