Ogp Project

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 0.6.0

Overview

This collaboration skill is not malicious, but it needs review because it can automatically share project intent and stored project details with approved peer agents.

Install only if you are comfortable with OGP storing project metadata and with approved peers' agents receiving some project context. Before enabling federation, review peer approvals and response policies, prefer escalate or summary modes for sensitive projects, avoid entering secrets or private paths you would not want collaborators to learn, and consider pinning or isolating the npm package installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-39 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml requires: bins: - ogp state_paths: - ~/.ogp-meta/config.json - ~/.ogp/config.json - ~/.ogp/projects.json - ~/.ogp/peers.json - ~/.ogp-hermes/config.json - ~/.ogp-hermes/projects.json - ~/.ogp-hermes/peers.json install: npm install -g @dp-pcs/ogp docs: https://github.com/dp-pcs/ogp --- ## Prerequisites The OGP daemon must be installed and configured. If you see errors like 'ogp: command not found', install it first: ```bash npm install -g @dp-pcs/ogp ``` ``` ### Technical Analysis The installation instructions retrieve the currently resolved version of `@dp-pcs/ogp` from the configured npm registry and install it globally. No exact version, package integrity value, provenance requirement, or lifecycle-script restriction is specified. An npm package can execute lifecycle scripts during installation. A global installation also places the package's executable in a shared command location, making it available to later sessions under the identity and permissions of the user performing the installation. Consequently, the code that executes may differ from the version reviewed when this Skill was published. This does not prove that the named package is malicious. The vulnerability is the absence of controls that bind installation to a reviewed artifact, leaving the Skill exposed to registry-account compromise, a malicious future release, registry substitution, or other supply-chain failures. ### Attack Path 1. An attacker compromises the package publisher, npm account, release process, or package distribution path. 2. The attacker publishes a malicious version under the existing `@dp-pcs/ogp` package name. 3. A user follows the Skill instructions and runs `npm install -g @dp-pcs/ogp`. 4. npm resolves the unpinne ...[truncated 870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example: ```bash npm install -g @dp-pcs/ogp@<audited-exact-version> ``` 2. Publish and verify the expected package integrity hash and package provenance before installation. 3. Document the npm registry that must be used and reject unexpected registry overrides. 4. Review package lifecycle scripts and, where operationally compatible, install with scripts disabled: ```bash npm install -g --ignore-scripts @dp-pcs/ogp@<audited-exact-version> ``` 5. Prefer a project-local or isolated installation over a global installation so that the executable cannot silently affect unrelated workflows. 6. Establish a controlled upgrade process in which each new version is reviewed before the pinned version is changed. 7. Recommend installation under an unprivileged account and explicitly warn users not to run the command with `sudo` or equivalent elevated privileges. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:109
• Finding: Mandatory Proactive Disclosure of User Work Intent to Peer Agents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 109-127 **Vulnerability Type**: Skill instructions trigger external communication without per-message confirmation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Proactive Pre-Task Check (MANDATORY) **This is the most important behavior in this skill.** Whenever the user expresses intent to start work on something project-related, run this flow BEFORE starting: ### Step 1: Check local project state ```bash # Quick scan of recent activity ogp --for openclaw project query <project-id> --limit 20 # Check for anything on this specific topic ogp --for openclaw project query <project-id> --search "<keywords from user's intent>" ``` ### Step 2: Query peer agents ```bash # For each approved peer in the project, ask if they know anything relevant ogp --for openclaw federation agent <peer-id> <project-id> "My user is about to start working on <what they said>. Anything I should know before we begin?" ``` ``` ### Technical Analysis The Skill makes peer communication mandatory whenever broadly defined project-related work begins. It instructs the agent to embed a description derived from what the user said into a federation message and send it to every approved project peer before beginning the requested task. Peer approval and response policies provide some access control, but they do not amount to consent for each disclosure. A user may approve a peer for general project collaboration without expecting every prospective task, feature, or work plan to be transmitted automatically. The broad trigger also increases the possibility that sensitive details included in ordinary conversation will be incorporated into an outbound message. The instruction alters the agent's normal task flow by requiring an external action before performing the user's requested work. Because this behavior is imposed by the Skill text and may occur without explicit confirmation for the particular mes ...[truncated 1612 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change proactive peer checks from mandatory to opt-in at the project level, with local-only checks as the default. 2. Request explicit user confirmation before the first outbound query and whenever a message may contain sensitive or newly introduced information. 3. Display the exact destination peers and proposed message before transmission. 4. Generate a minimal, redacted query rather than interpolating the user's statement directly. Exclude credentials, personal data, unreleased names, deadlines, file paths, and implementation details by default. 5. Permit users to configure peer-specific disclosure policies, such as: - local checks only; - ask before sending; - metadata-only queries; - summary queries; - automatic full-context queries. 6. Add an explicit command or conversational action for enabling proactive federation instead of activating it from any broadly project-related statement. 7. Validate that every destination peer is currently approved for the specific project and topic immediately before transmission. 8. Log outbound disclosures locally with the destination, timestamp, and redacted message so users can review what was shared. 9. Ensure peer timeouts never block the underlying user task indefinitely; continue with an explicit caveat where appropriate. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The project interview explicitly collects and stores sensitive operational details such as note locations, repository paths, workspace paths, collaborators, and free-text context, and states that peer agents can query this later. Centralizing this metadata materially increases exposure because it maps where valuable information lives and facilitates later disclosure to collaborators' agents.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction to use the skill proactively before any project-related work is underspecified and can cause the agent to invoke project queries and peer contact far more often than users expect. Because this skill interacts with local state and external peers, ambiguous proactive invocation increases the chance of unnecessary disclosure of user intent and project metadata.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill promotes querying peer agents and surfacing shared context but does not clearly warn users that their project details, work intent, and stored context may be transmitted to external collaborators' agents. That omission undermines informed consent and can lead users to disclose sensitive project information unintentionally.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The default design encourages the agent to proactively gather local project context and query peer agents without a per-request consent check. This can disclose user intent, project names, collaborators, and other sensitive context by default, especially when users may not realize a simple project-related prompt triggers external communication.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to activate on routine conversational language such as 'remember this' or 'make note of' without clear confirmation that the user wants OGP storage or cross-peer behavior. In this skill, unintended activation is more dangerous because activation can lead to persistence and federation actions rather than a harmless local helper response.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Broad natural-language logging detection can cause the agent to persist information from ordinary conversation without sufficiently clear user consent. In a collaboration skill, this is particularly risky because logs may later be queried, summarized, or shared with peers, amplifying the impact of accidental capture.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The mandatory pre-task flow instructs the agent to ask approved peers for 'anything relevant' before work begins, which automatically reveals what the user is about to do and may solicit sensitive project context in return. This creates a routine outbound disclosure channel tied to ordinary work initiation, making over-sharing likely rather than exceptional.

Session Persistence

Medium

• Category: Rogue Agent

Content

```
📝 I can log this for you. Which project?
Active: [list from `ogp --for openclaw project list`]
Or name a new one to create it.
```

### Entry Type Selection

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The incoming peer-query workflow directs the agent to search local project data and answer peers under 'full' or 'summary' modes, enabling disclosure of stored user and project information through automated responses. Even with policy levels, this still creates a broad exfiltration surface if permissions are configured too loosely or users do not understand the consequences of auto-answering.

Static analysis

No suspicious patterns detected.