Noverload - Knowledge Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

The skill has a clear purpose, but it should be reviewed because it automatically runs the latest npm package while using a saved access token.

Review this skill before installing. Use it only if you trust the Noverload MCP npm package and the publisher's update process. Prefer a pinned package version, keep the default read-only mode unless you explicitly need saving, store the token with restrictive local permissions, and revoke or rotate the token when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Automatic Execution of an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–9
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

yaml

mcp-server:
  command: npx
  args: ["-y", "noverload-mcp@latest"]
  env:
    NOVERLOAD_CONFIG: '{"accessToken":"${NOVERLOAD_TOKEN}","apiUrl":"https://www.noverload.com","readOnly":true}'

The behavior is also described at line 51:

text

The skill spawns the Noverload MCP server automatically via npx when activated.

Technical Analysis

The Skill invokes npx with the mutable package reference noverload-mcp@latest. The latest tag does not identify a fixed, previously audited artifact; it resolves to whichever package release the publisher currently designates. Consequently, the code executed during activation can change after this Skill has been reviewed.

The -y option automatically accepts installation prompts, so package retrieval and execution occur without an additional confirmation step. No exact version, lockfile, package integrity hash, or signature is specified. An attacker who compromises the npm package, its publisher account, or the package distribution process could therefore introduce arbitrary code into a future release.

Although the configured MCP mode is read-only at the application level, that setting does not sandbox the npm process itself. Package lifecycle code and the launched MCP server execute with the operating-system permissions of the agent process and can access inherited environment variables, including NOVERLOAD_TOKEN.

Attack Path

1. An attacker compromises the noverload-mcp npm package, its maintainer account, or the package publication pipeline.
2. The attacker publishes a malicious release and assigns it to the npm latest distribution tag.
3. A user activates the Skill.
4. The Skill executes npx -y noverload-mcp@latest.
5. npx retrieves and runs the attacker-cont ...[truncated 984 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace noverload-mcp@latest with an exact, reviewed version, such as noverload-mcp@1.2.3.
2. Verify the package against a trusted lockfile and npm integrity hash before execution.
3. Establish a controlled update process in which each new version is reviewed and tested before changing the pinned version.
4. Avoid npx -y for automatic retrieval and execution where possible. Prefer a preinstalled, verified dependency from a controlled deployment process.
5. Run the MCP server in a sandbox or isolated container with narrowly scoped filesystem and network access.
6. Expose only the required environment variable to the MCP process and prevent access to unrelated credentials.
7. Use a least-privilege, revocable Noverload token and retain read-only mode unless write capabilities are explicitly required.
8. Monitor package provenance and publisher changes, and verify signatures or attestations when supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

1. Sign up at https://noverload.com (free tier available)
2. Go to Settings > Apps
3. Click "New Token" to create a personal access token
4. Copy the token (you won't see it again)

### 2. Configure OpenClaw

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill launches an MCP server via npx -y noverload-mcp@latest, which pulls and executes the latest package version at runtime with no pinning or integrity control. This creates a supply-chain execution risk: a compromised publisher account, malicious dependency update, or unexpected breaking release would run arbitrary code in the agent environment and can access the configured token.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The setup instructs users to place a long-lived personal access token in persistent local configuration under ~/.openclaw/openclaw.json. Persisting bearer credentials in a general config file increases exposure through local compromise, backups, logs, or other tooling that can read the file, and the risk is amplified because the skill also downloads executable code at runtime.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

1. Sign up at https://noverload.com (free tier available)
2. Go to Settings > Apps
3. Click "New Token" to create a personal access token
4. Copy the token (you won't see it again)

### 2. Configure OpenClaw

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This text explicitly documents that the skill spawns the MCP server automatically via npx, reinforcing the same runtime code-fetch behavior described in the metadata. While this line is documentation rather than executable configuration by itself, it normalizes an unsafe installation pattern that results in unpinned remote code execution when the skill is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The command examples and guidance say to 'Ask naturally' for queries like 'Find content about machine learning in my library' and similar phrases, but they do not define a bounded trigger set or exclusion conditions. In a user-invocable markdown skill description, this kind of broad natural-language activation guidance can overlap with ordinary conversation about saved material and make invocation scope unclear.

Content

No source excerpt is available for this finding.