AOI Starter Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 0.1.1

Overview

This starter pack is coherent but should be reviewed because it non-interactively installs multiple mutable third-party skills into the user's ClawHub environment.

Before installing, review the listed skills and their publishers, prefer pinned versions or verified publisher/digest information if ClawHub supports it, and avoid the full mode unless you are comfortable adding all 13 persistent skills to your agent environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_pack.sh:9

Finding

Unpinned Non-Interactive Installation of Third-Party Skills

Content

View full analysis

Vulnerability Details

File Location: scripts/install_pack.sh, lines 9–35 and 47–50
Vulnerability Type: Third-party supply-chain risk caused by mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

bash

core=(
  aoi-openclaw-security-toolkit-core
  aoi-prompt-injection-sentinel
  aoi-sandbox-shield-lite
  aoi-cron-ops-lite
  token-guard
)

minimal=(
  aoi-openclaw-security-toolkit-core
  aoi-cron-ops-lite
)

full=(
  aoi-openclaw-security-toolkit-core
  aoi-prompt-injection-sentinel
  aoi-sandbox-shield-lite
  aoi-cron-ops-lite
  token-guard
  publish-guard
  aoi-triple-memory-lite
  aoi-council
  aoi-hackathon-scout-lite
  aoi-squad-orchestrator-lite
  aoineco-squad-dispatch
  aoineco-ledger
  aoi-demo-clip-maker
)

for s in "${skills[@]}"; do
  echo "- clawhub install $s" >&2
  clawhub install "$s" --no-input
done

Technical Analysis

The script installs external ClawHub skills using package names alone. It does not pin immutable versions or content digests, verify package signatures or publisher identity, or compare downloaded content against an approved lockfile. The --no-input option also suppresses interactive confirmation during installation.

Consequently, the reviewed installer does not uniquely identify the content that will be installed. A package can change after this project has been audited while retaining the same name. Although the documentation attributes the bundle to a particular publisher, the installation command does not enforce that attribution.

The issue applies to all modes: minimal installs two external skills, core installs five, and full installs thirteen.

Attack Path

1. An attacker compromises a listed package or its publisher account, takes control of a transferred package name, or otherwise causes malicious content to be published under one of the listed names.
2. A user invokes `script ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every skill to an immutable version and, where supported, a cryptographic content digest.
2. Maintain a reviewed lockfile mapping each skill name to its expected publisher, version, and digest.
3. Verify registry signatures and publisher identity before installation, failing closed when verification is unavailable or unsuccessful.
4. Remove --no-input for untrusted or first-time installations, or add an explicit confirmation step that displays the exact resolved versions and publishers.
5. Download dependencies into a staging area and review or scan their instructions and executable files before making them available to the agent.
6. Install skills with least privilege and isolate their execution from credentials, sensitive files, network access, and privileged tools unless explicitly required.
7. Use a trusted internal mirror or approved allowlist to prevent package substitution and unexpected upstream changes.
8. Add automated integrity checks in CI and before runtime installation so that any deviation from the reviewed dependency set aborts the process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep