ClawHub
Back to skill

Security audit

Windows Notifier

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible Windows notification helper, but it automatically installs npm dependencies at runtime and invokes PowerShell with execution-policy bypass, so it needs review before installation.

Install only if you are comfortable with the skill running local Node and PowerShell commands and allowing npm dependency installation on first use. Prefer a version that installs reviewed dependencies during setup, pins dependencies exactly, uses npm ci with lifecycle scripts disabled where possible, and limits activation to explicit user requests for local notifications.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/send-notification.js:17
Finding

Automatic Runtime Installation of Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
- **Windows + WPF available** → prefer the built-in WPF modern card path in `send-notification.js`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill instructs the agent to execute a local Node.js script and access environment-derived paths, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization ambiguity where a broadly invokable skill can run local code without clear guardrails, increasing the chance of unintended execution or abuse through the notification pathway.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description is broad enough to match many ordinary reminder, alert, and popup-related requests, which can cause the skill to activate in situations where the user did not clearly ask for a local system notification. Because activation leads to code execution on the host, overly broad routing increases the risk of unnecessary or user-surprising local actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The guidance to prefer this notifier when reminders may be missed encourages proactive triggering without firm user-consent boundaries or disqualifying conditions. In context, that means an agent may choose local desktop notification execution based on vague heuristics, leading to intrusive behavior or unexpected host-side actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script silently performs npm install at runtime when node-notifier is missing, which expands a simple local notification capability into network access and arbitrary package lifecycle script execution. In a skill whose stated purpose is only to display local Windows notifications, this behavior is dangerous because it can fetch unpinned dependencies, execute install-time scripts, and change the host environment without explicit user consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill launches shell and PowerShell processes, including use of -ExecutionPolicy Bypass, to probe and display notifications. Although user-controlled title/message values are single-quote escaped and the main PowerShell payload is base64-encoded, bypassing execution policy weakens host safeguards and makes the skill more capable than its notification-only description suggests; combined with runtime package installation, it increases abuse potential on Windows hosts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The lockfile pins uuid 8.3.2, which is reported as affected by a buffer bounds check flaw in certain v3/v5/v6 code paths when a caller supplies a buf parameter. This is a real dependency risk, though in this skill's context it appears only as a transitive dependency of node-notifier and there is no evidence in this file that the vulnerable API is directly reachable, so practical exploitability is limited.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The dependency uses a caret range (^10.0.1), which allows newer minor and patch releases to be installed. This can introduce supply-chain risk because future upstream releases may change behavior or contain malicious or vulnerable code without this skill explicitly reviewing and pinning the exact version.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"description": "Windows notifier wrapper for OpenClaw workspace skill",
  "license": "UNLICENSED",
  "dependencies": {
    "node-notifier": "^10.0.1"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script defaults the notification title and message to Chinese text literals, which imposes a specific language when the caller does not provide custom values. This is a natural-language policy concern because the file does not offer a locale choice or document the language restriction as an intentional, region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/send-notification.js:27