LiveAvatar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:41 AM UTC
• Version: 1.0.1

Overview

This skill appears purpose-aligned, but it asks users to run an unpinned npm package that will handle microphone input, an API key, and local agent connectivity.

Review this before installing. The skill is meant to let you talk to your agent through LiveAvatar, so microphone audio, transcripts, agent responses, a LiveAvatar API key, and local gateway access are part of the workflow. The main concern is that it runs an unpinned npm package, so you should only use it if you trust the package publisher and are comfortable with the current package version executing locally; prefer a pinned, reviewed version and avoid speaking secrets or regulated data unless you have reviewed LiveAvatar's privacy and retention terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Third-Party npm Package Is Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 46–49
Vulnerability Type: Unpinned third-party dependency and runtime package execution
Risk Level: Medium

The skill declares openclaw-liveavatar as an npm dependency without an exact version or integrity constraint and instructs the agent to execute it through npx:

yaml

metadata: {"openclaw":{"emoji":"🎭","requires":{"env":["LIVEAVATAR_API_KEY"],"bins":["node","npm"]},"install":[{"id":"node","kind":"node","package":"openclaw-liveavatar","bins":["openclaw-liveavatar"],"label":"Install LiveAvatar (npm)"}]}}

markdown

2. **Launch the interface**:
   ```bash
   npx openclaw-liveavatar
   ```

Technical Analysis

Neither the installation metadata nor the launch command pins a reviewed package version or verifies package integrity. When the package is unavailable locally, npx openclaw-liveavatar can retrieve the package currently published under that name and immediately execute its lifecycle or application code.

Consequently, the effective executable payload can change after this skill has been audited. The project contains no copy of the package source, lockfile, checksum, or signature with which to verify that the code executed at runtime is the code previously reviewed.

This is particularly sensitive because the launched process is expected to receive LIVEAVATAR_API_KEY, interact with a microphone-enabled browser workflow, and communicate with an OpenClaw Gateway on local port 18789. This finding does not establish that the currently published package is malicious; it identifies the unsafe, mutable dependency-execution mechanism.

Attack Path

1. An attacker compromises the npm publisher account, registry release process, or another component capable of publishing a malicious release under openclaw-liveavatar.
2. The attacker publishes a modified package version containing malicious lifecycle or runtime code.

...[truncated 1335 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openclaw-liveavatar to an exact, reviewed version in both installation metadata and execution instructions.
2. Install the dependency during a controlled build or setup phase rather than downloading it through npx at each invocation.
3. Commit a lockfile that records resolved versions and registry integrity hashes, and enforce immutable or reproducible installation in deployment.
4. Prefer invoking an already installed, verified binary, such as through a package script or an explicit local node_modules/.bin path.
5. Use npx --no-install if npx remains necessary, preventing an invocation from silently downloading an absent package.
6. Verify package provenance or signatures where supported, restrict installation to an approved registry, and continuously scan the dependency and its transitive dependency tree.
7. Review or vendor the executable source so its microphone, credential, filesystem, gateway, and outbound-network behavior can be audited.
8. Run the package with least privilege and isolate it from unrelated credentials, files, and local services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and usage text do not clearly warn that live microphone audio, transcriptions, and agent responses are sent to external services and the OpenClaw Gateway. In a voice/avatar skill, this omission increases the chance that users disclose sensitive spoken information without informed consent, making the privacy risk contextually significant.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

### 1. Get Your API Key (Free)

1. Go to [app.liveavatar.com](https://app.liveavatar.com)
2. Create a free account
3. Copy your API key from the dashboard

### 2. Set Your API Key

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx openclaw-liveavatar without pinning a specific package version. That causes execution of whatever version the npm registry serves at runtime, which creates a supply-chain risk if a malicious or compromised release is published, especially because the package will handle microphone input and API-backed communications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.