Openclaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:45 AM UTC
• Version: 2.0.0

Overview

This book-analysis skill is coherent, but it automatically installs unpinned Python packages and tells generated HTML to use remote CDN JavaScript, so it should be reviewed before use.

Install only if you are comfortable with the agent changing the Python environment and the generated HTML loading third-party JavaScript. Prefer running it in a sandbox, preinstalling reviewed pinned dependencies, and replacing the CDN script with a local pinned copy before opening generated readers with network access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Python Dependencies Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install ebooklib beautifulsoup4

Technical Analysis

The skill instructs the agent to install ebooklib and beautifulsoup4 at runtime without specifying exact versions, package hashes, a lock file, or an explicitly trusted package index. Consequently, the installed artifacts are resolved dynamically and may differ from those available when the skill was audited.

Runtime package installation expands the effective behavior of this documentation-only skill to include third-party installation and package code execution. A compromised upstream release, dependency, package index, or package-resolution configuration could introduce attacker-controlled code. Installation hooks and imported package code may execute with the privileges of the user running the agent.

Attack Path

1. An attacker compromises a requested package, one of its transitive dependencies, or the package source used by pip.
2. The attacker publishes a malicious version that still satisfies the unbounded dependency request.
3. The skill receives an EPUB file and directs the agent to install the missing packages.
4. pip resolves and installs the attacker-controlled release.
5. Malicious installation hooks or package code execute under the agent user's account.
6. The payload can access resources available to that account, including project files, input books, generated summaries, environment variables, and writable local paths.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account running the agent. The scope is limited by that account's operating-system permissions and sandbox restrictions, but may include reading or modifying local files, accessing sensitive environment variables, altering g ...[truncated 175 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to reviewed versions in a lock file.
• Require package hashes, such as with pip install --require-hashes -r requirements.txt.
• Use an explicitly configured and trusted package index or an internally controlled package mirror.
• Prefer preinstalled dependencies from a reviewed environment instead of performing installation during skill execution.
• Disable source builds and installation scripts where operationally possible.
• Run document conversion in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted network access.
• Add dependency scanning and scheduled review of pinned versions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:121

Finding

Mutable CDN JavaScript Loaded by the Generated Reader

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:121
Vulnerability Type: Unspecified third-party browser dependency
Risk Level: Medium

Vulnerable Code Snippet

text

marked.js CDN

The directive requires the generated reader to render Markdown through marked.js loaded from a CDN, but it does not specify an exact version, trusted URL, integrity hash, or restrictive Content Security Policy.

Technical Analysis

Loading JavaScript from an unspecified CDN makes the generated reader's effective code mutable after the skill has been reviewed. The remote resource may change due to an upstream compromise, CDN compromise, version drift, DNS or network interference, or unsafe URL selection during HTML generation.

JavaScript loaded by the page executes in the reader's browser context. This design also conflicts with the later requirement that the HTML reader be static and self-contained. Although the skill explicitly prohibits embedded API keys and external AI service calls, that instruction does not prevent a compromised CDN script from initiating unauthorized network requests.

Attack Path

1. The generated HTML references a mutable or insufficiently pinned CDN-hosted marked.js resource.
2. An attacker compromises the CDN resource, its upstream package, or the network resolution path.
3. A user opens the generated interactive reader while external resource loading is permitted.
4. The browser retrieves and executes the malicious JavaScript.
5. The script reads content available in the page, modifies rendered summaries, captures reader interactions, or sends accessible data to an attacker-controlled endpoint.
6. The payload remains effective for generated readers as long as they continue to reference the compromised remote resource.

Impact Assessment

Exploitation provides script execution in the browser context of the generated reader. The attacker may read and alter the displayed book sum ...[truncated 343 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle a reviewed and fixed version of marked.js directly into the generated HTML or as a local packaged asset.
• If remote hosting is unavoidable, specify an exact immutable version and trusted HTTPS URL.
• Add Subresource Integrity metadata and an appropriate crossorigin attribute.
• Apply a restrictive Content Security Policy that blocks unapproved scripts, connections, frames, and other external resources.
• Avoid runtime network dependencies so the reader is genuinely self-contained.
• Sanitize rendered Markdown and disable raw HTML unless it is explicitly required.
• Test the generated reader with network access disabled to confirm that all expected functionality remains available.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L021 明确要求“所有输出必须使用中文（简体中文）”，属于对语言/locale 的强制性要求。文件中未提供用户可选择其他语言的选项，也未说明这是仅适用于特定地区或合规场景的必要限制，因此构成自然语言层面的语言策略违规。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to modify the runtime environment by installing Python packages with pip during execution. Even though the stated purpose is EPUB parsing, on-the-fly dependency installation expands the skill’s capabilities beyond passive document analysis, introduces supply-chain risk, and can alter the host environment in ways the user did not explicitly approve.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.