morning-brief

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Chinese holiday countdown reminder with limited network access and local caching, though its dependency pinning could be improved.

Before installing, consider that the skill runs automatically every morning, contacts an external holiday-calendar endpoint, and caches the response locally. For stronger supply-chain safety, use a lockfile or pinned dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:19
• Finding: Unpinned Dependencies and Missing Lockfile Permit Unreviewed Package Code<![CDATA[ ## Vulnerability Details **File Location**: `package.json:19-22`; also documented in `SKILL.md:28-31` and duplicated in `clawhub.json:17-20` **Vulnerability Type**: Supply-chain risk caused by mutable dependency resolution **Risk Level**: Medium ### Complete Code Snippets `package.json:19-22`: ```json "dependencies": { "axios": "^1.6.0", "dayjs": "^1.11.0" } ``` `SKILL.md:28-31`: ```bash cd skills/morning-brief npm install ``` `clawhub.json:17-20`: ```json "dependencies": { "axios": "^1.6.0", "dayjs": "^1.11.0" } ``` ### Technical Analysis The project declares `axios` and `dayjs` with caret version ranges and does not include a package lockfile. Consequently, the documented `npm install` command can resolve dependency versions that differ from those reviewed during this audit. A caret range permits compatible newer releases, including transitive dependencies selected at installation time. If a permitted dependency release or one of its transitive dependencies is compromised, installation can introduce unreviewed code. npm packages may also define lifecycle scripts that execute during installation unless scripts are explicitly disabled. The audited source does not contain evidence that the currently named dependencies are malicious. The issue is the absence of reproducible and integrity-controlled dependency resolution, which creates a conditional supply-chain exploitation path. ### Attack Path 1. An attacker compromises a permitted future release of a declared dependency or one of its transitive dependencies. 2. The attacker adds malicious runtime logic or an npm lifecycle script to that release. 3. A user follows the documented installation procedure and runs `npm install`. 4. npm resolves the compromised version because the caret range allows it and no lockfile constrains resolution to an audited dependency graph. 5. A malicious lifecycle script executes during installation, or malicious package code executes when `main.js` impor ...[truncated 650 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version rather than using caret ranges: ```json "dependencies": { "axios": "1.6.0", "dayjs": "1.11.0" } ``` 2. Generate and commit `package-lock.json` so direct and transitive dependency versions and integrity hashes are reproducible. 3. Replace deployment and installation instructions using `npm install` with `npm ci`, which installs the locked dependency graph and fails when the manifest and lockfile disagree. 4. Review the complete locked dependency tree, including transitive packages, before release. 5. Use automated dependency scanning and update dependencies through reviewed pull requests. 6. Where operationally compatible, disable package lifecycle scripts during installation with `npm ci --ignore-scripts`, enabling only explicitly reviewed scripts when necessary. 7. Run installation and the Skill under a dedicated, least-privileged account or isolated container without unnecessary credentials or writable host paths. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The README presents the skill entirely in Chinese and the sample output is also fixed to Chinese, but it does not say the skill is China-specific or that users can choose their preferred language. This can violate language/locale policy when a skill implicitly forces one language without opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest description is written only in Chinese and describes the skill as a Chinese holiday countdown/reminder, which implies a fixed language/locale experience without any user opt-in or language choice. Under the policy, locale or language constraints should be optional or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script emits its user-facing text entirely in Chinese and does not provide any option to choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This code retrieves holiday data from an external URL and writes it to a local JSON cache file, but there is no user-facing notice before or during these operations. While the script logs the final output and reports errors, it does not disclose that it performs network access and persistent local file writes.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The manifest description is written as a Chinese-only user-facing skill description, indicating the skill provides content in a specific language. There is no accompanying indication that users can choose another language or opt in to the locale, which can violate language/locale policy requirements.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "OpenClaw Community",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "dayjs": "^1.11.0"
  }
}

• Confidence: 90% confidence
• Finding: Using a caret range for axios allows installation of newer matching versions without strict review, which weakens build reproducibility and can unexpectedly pull in vulnerable or behavior-changing releases. Because axios is a network-facing library with multiple advisories, loose versioning increases supply-chain and exposure risk.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest references axios without an exact pinned version, and axios has multiple known advisories in some releases. Without a lockfile or exact version, it is not possible to verify whether deployments will resolve to a safe release, leaving the skill potentially exposed to known issues such as SSRF or request-handling weaknesses depending on usage in code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "dayjs": "^1.11.0"
  }
}

• Confidence: 82% confidence
• Finding: Using a caret range for dayjs permits automatic minor/patch upgrades, reducing reproducibility and increasing supply-chain uncertainty. While the direct risk is lower than for a network client, unpinned dependencies still make it harder to guarantee the deployed code matches what was reviewed.

Static analysis

No suspicious patterns detected.