Security audit

EctoClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly disclosed audit-logging integration, but users should treat its logs and npm install path carefully because both can carry sensitive risk.

Install only if you intend to run an audit service that may store sensitive prompts, tool results, and memory-related data. Keep `ECTOCLAW_URL` pointed at a local or trusted private instance, add authentication before any network exposure, and consider pinning or reviewing the npm package version before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 14–19 and 163–166 **Vulnerability Type**: Supply-chain risk from an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: requires: bins: [] install: - id: node kind: node package: ectoclaw bins: ["ectoclaw"] label: "Install EctoClaw (npm)" ``` ```bash npm install ectoclaw npx ectoclaw serve --dev ``` ### Technical Analysis The Skill installs and executes the external `ectoclaw` npm package without specifying an exact version, lockfile, integrity hash, or package-signature verification procedure. Consequently, installation can resolve to a release that differs from the version originally reviewed. The dependency's implementation is not included in this project, so its installation scripts and runtime behavior cannot be verified from the audited artifact. If the npm publisher account, package distribution channel, or a future release is compromised, following these instructions could install and execute attacker-controlled code. The `npx ectoclaw serve --dev` command also executes the resolved package binary. This turns dependency compromise into a direct local code-execution path under the permissions of the user running the command. ### Attack Path 1. An attacker compromises the `ectoclaw` npm publisher account or causes a malicious release to become the version resolved by an unpinned installation. 2. A user or automated Skill installer processes `package: ectoclaw`, or the user runs `npm install ectoclaw`. 3. npm downloads the current package release rather than a fixed, previously audited version. 4. Package installation hooks may execute with the invoking user's permissions. 5. The user runs `npx ectoclaw serve --dev`, directly executing the package binary. 6. The compromised dependency can perform arbitrary actions available to that user, including accessing data processed by the adve ...[truncated 668 chars]
Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version rather than resolving the latest release: ```yaml package: ectoclaw@<reviewed-exact-version> ``` 2. Update the quick-start command to install the same exact version: ```bash npm install --save-exact ectoclaw@<reviewed-exact-version> ``` 3. Provide and enforce a lockfile containing npm integrity metadata. 4. Verify package provenance, registry origin, signatures, or published integrity hashes before installation. 5. Avoid ambiguous `npx` resolution. Execute the explicitly installed, pinned local binary, such as: ```bash ./node_modules/.bin/ectoclaw serve --dev ``` 6. Audit package lifecycle scripts and runtime source before approving version upgrades. 7. Perform upgrades through a controlled review process and use reproducible builds or signed release artifacts where available. 8. Run the service under a dedicated, least-privileged account with restricted filesystem, environment-variable, and network access to limit the consequences of dependency compromise.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger language for creating an audit session is broad (`start a new audit`, `begin tracking`) and may match ordinary user requests that are not explicit authorization to create a persistent logging session. In this skill's context, creating a session can cause sensitive goals and future actions to be recorded to an external service, so accidental activation can lead to unintended data disclosure and privacy/compliance issues.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The append-event behavior is triggered by vague phrases like `log an action`, `record an event`, or `track an operation` without clear scope, source, or consent checks. Because EctoClaw records highly sensitive agent activity including messages, tool outputs, and memory contents, an overly broad trigger can cause the agent to exfiltrate confidential data into the audit system or create a detailed surveillance trail without deliberate user approval.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The quick-start command uses `npx ectoclaw` without pinning a specific package version, which can fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised or newly published version could execute attacker-controlled code during install or startup, especially because this is presented as a security-sensitive auditing tool that users may trust highly.

Static analysis

No suspicious patterns detected.