EctoClaw

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:11 PM UTC
• Version: 0.1.3

Overview

The skill is a clearly disclosed audit-logging integration, but users should treat its logs and npm install path carefully because both can carry sensitive risk.

Install only if you intend to run an audit service that may store sensitive prompts, tool results, and memory-related data. Keep `ECTOCLAW_URL` pointed at a local or trusted private instance, add authentication before any network exposure, and consider pinning or reviewing the npm package version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19 and 163–166
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      bins: []
    install:
      - id: node
        kind: node
        package: ectoclaw
        bins: ["ectoclaw"]
        label: "Install EctoClaw (npm)"

bash

npm install ectoclaw
npx ectoclaw serve --dev

Technical Analysis

The Skill installs and executes the external ectoclaw npm package without specifying an exact version, lockfile, integrity hash, or package-signature verification procedure. Consequently, installation can resolve to a release that differs from the version originally reviewed.

The dependency's implementation is not included in this project, so its installation scripts and runtime behavior cannot be verified from the audited artifact. If the npm publisher account, package distribution channel, or a future release is compromised, following these instructions could install and execute attacker-controlled code.

The npx ectoclaw serve --dev command also executes the resolved package binary. This turns dependency compromise into a direct local code-execution path under the permissions of the user running the command.

Attack Path

1. An attacker compromises the ectoclaw npm publisher account or causes a malicious release to become the version resolved by an unpinned installation.
2. A user or automated Skill installer processes package: ectoclaw, or the user runs npm install ectoclaw.
3. npm downloads the current package release rather than a fixed, previously audited version.
4. Package installation hooks may execute with the invoking user's permissions.
5. The user runs npx ectoclaw serve --dev, directly executing the package binary.
6. The compromised dependency can perform arbitrary actions available to that user, including accessing data processed by the adve ...[truncated 668 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than resolving the latest release:

   yaml

   package: ectoclaw@<reviewed-exact-version>
   

2. Update the quick-start command to install the same exact version:

   bash

   npm install --save-exact ectoclaw@<reviewed-exact-version>
   

3. Provide and enforce a lockfile containing npm integrity metadata.
4. Verify package provenance, registry origin, signatures, or published integrity hashes before installation.
5. Avoid ambiguous npx resolution. Execute the explicitly installed, pinned local binary, such as:

   bash

   ./node_modules/.bin/ectoclaw serve --dev
   

6. Audit package lifecycle scripts and runtime source before approving version upgrades.
7. Perform upgrades through a controlled review process and use reproducible builds or signed release artifacts where available.
8. Run the service under a dedicated, least-privileged account with restricted filesystem, environment-variable, and network access to limit the consequences of dependency compromise.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger language for creating an audit session is broad (start a new audit, begin tracking) and may match ordinary user requests that are not explicit authorization to create a persistent logging session. In this skill's context, creating a session can cause sensitive goals and future actions to be recorded to an external service, so accidental activation can lead to unintended data disclosure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The append-event behavior is triggered by vague phrases like log an action, record an event, or track an operation without clear scope, source, or consent checks. Because EctoClaw records highly sensitive agent activity including messages, tool outputs, and memory contents, an overly broad trigger can cause the agent to exfiltrate confidential data into the audit system or create a detailed surveillance trail without deliberate user approval.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The quick-start command uses npx ectoclaw without pinning a specific package version, which can fetch whatever version is current at execution time. That creates a supply-chain risk: a compromised or newly published version could execute attacker-controlled code during install or startup, especially because this is presented as a security-sensitive auditing tool that users may trust highly.

Content

No source excerpt is available for this finding.