ClawHub
Back to skill

Security audit

LiveAvatar

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it asks users to run an unpinned npm package that will handle microphone input, an API key, and local agent connectivity.

Review this before installing. The skill is meant to let you talk to your agent through LiveAvatar, so microphone audio, transcripts, agent responses, a LiveAvatar API key, and local gateway access are part of the workflow. The main concern is that it runs an unpinned npm package, so you should only use it if you trust the package publisher and are comfortable with the current package version executing locally; prefer a pinned, reviewed version and avoid speaking secrets or regulated data unless you have reviewed LiveAvatar's privacy and retention terms.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding
Unpinned Third-Party npm Package Is Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 46–49 **Vulnerability Type**: Unpinned third-party dependency and runtime package execution **Risk Level**: Medium The skill declares `openclaw-liveavatar` as an npm dependency without an exact version or integrity constraint and instructs the agent to execute it through `npx`: ```yaml metadata: {"openclaw":{"emoji":"🎭","requires":{"env":["LIVEAVATAR_API_KEY"],"bins":["node","npm"]},"install":[{"id":"node","kind":"node","package":"openclaw-liveavatar","bins":["openclaw-liveavatar"],"label":"Install LiveAvatar (npm)"}]}} ``` ```markdown 2. **Launch the interface**: ```bash npx openclaw-liveavatar ``` ``` ### Technical Analysis Neither the installation metadata nor the launch command pins a reviewed package version or verifies package integrity. When the package is unavailable locally, `npx openclaw-liveavatar` can retrieve the package currently published under that name and immediately execute its lifecycle or application code. Consequently, the effective executable payload can change after this skill has been audited. The project contains no copy of the package source, lockfile, checksum, or signature with which to verify that the code executed at runtime is the code previously reviewed. This is particularly sensitive because the launched process is expected to receive `LIVEAVATAR_API_KEY`, interact with a microphone-enabled browser workflow, and communicate with an OpenClaw Gateway on local port `18789`. This finding does not establish that the currently published package is malicious; it identifies the unsafe, mutable dependency-execution mechanism. ### Attack Path 1. An attacker compromises the npm publisher account, registry release process, or another component capable of publishing a malicious release under `openclaw-liveavatar`. 2. The attacker publishes a modified package version containing malicious lifecycle or runtime code. ...[truncated 1335 chars]
Remediation
## Remediation Suggestions 1. Pin `openclaw-liveavatar` to an exact, reviewed version in both installation metadata and execution instructions. 2. Install the dependency during a controlled build or setup phase rather than downloading it through `npx` at each invocation. 3. Commit a lockfile that records resolved versions and registry integrity hashes, and enforce immutable or reproducible installation in deployment. 4. Prefer invoking an already installed, verified binary, such as through a package script or an explicit local `node_modules/.bin` path. 5. Use `npx --no-install` if `npx` remains necessary, preventing an invocation from silently downloading an absent package. 6. Verify package provenance or signatures where supported, restrict installation to an approved registry, and continuously scan the dependency and its transitive dependency tree. 7. Review or vendor the executable source so its microphone, credential, filesystem, gateway, and outbound-network behavior can be audited. 8. Run the package with least privilege and isolate it from unrelated credentials, files, and local services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill description and usage text do not clearly warn that live microphone audio, transcriptions, and agent responses are sent to external services and the OpenClaw Gateway. In a voice/avatar skill, this omission increases the chance that users disclose sensitive spoken information without informed consent, making the privacy risk contextually significant.

Session Persistence

Medium
Category
Rogue Agent
Content
### 1. Get Your API Key (Free)

1. Go to [app.liveavatar.com](https://app.liveavatar.com)
2. Create a free account
3. Copy your API key from the dashboard

### 2. Set Your API Key
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs users to run `npx openclaw-liveavatar` without pinning a specific package version. That causes execution of whatever version the npm registry serves at runtime, which creates a supply-chain risk if a malicious or compromised release is published, especially because the package will handle microphone input and API-backed communications.

Static analysis

No suspicious patterns detected.