@openclaw/interchange

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:14 PM UTC
• Version: 1.0.0

Overview

The package appears to be a real OpenClaw interchange library, but its public file APIs are too broad and include unsafe write behavior that could affect files outside the intended workspace.

Review before installing. This does not look malicious, but it is a foundational file-writing library with raw path access. Only use it with trusted callers, keep interchange paths constrained to a dedicated workspace, avoid passing user-supplied paths directly, and update the flagged dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/io.js:15

Finding

Predictable Temporary File Allows Symlink-Based Arbitrary File Overwrite

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/io.js:15

Finding

Public File APIs Permit Unrestricted Filesystem Access

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The declared vitest range resolves to a version with critical advisories involving arbitrary file read and possible execution, but vitest is only a devDependency and is not part of the runtime library surface. This still matters in developer and CI environments, where a vulnerable test tool or UI server could expose sensitive files or enable compromise if used in an unsafe way.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CODEX_REVIEW.md (reported line 111)May include surrounding context.

md

### 13. No path traversal protection (io.js, indexer.js)

`writeMd`, `atomicWrite`, `readMd` accept arbitrary paths. A skill could write to `../../etc/passwd` or any location. While skills are trusted code, defense-in-depth would restrict writes to within `INTERCHANGE_ROOT`.

**Fix:** Add an optional `assertWithinRoot(filePath)` guard to `writeMd`.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a Markdown/shared interchange library dealing with file serialization, YAML frontmatter, locking, and schema validation. The supplied code does none of those things. Instead, it provides resilience control for external API calls via a circuit breaker pattern. This is a materially different primary purpose and introduces undeclared capabilities unrelated to the declared library functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description emphasizes foundational Markdown interchange features such as atomic writes, deterministic serialization, YAML frontmatter handling, advisory locking, and schema validation. The supplied code chunk does not implement those capabilities. Instead, it contains miscellaneous helper/formatting functions, only one of which tangentially relates to markdown via a table serializer re-export. The presence of slugification, currency formatting, and relative time formatting indicates a materially different purpose from the declared shared .md interchange library. Therefore, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code chunk is an index file that re-exports library modules. It does support the declared purpose around Markdown interchange, atomic I/O, locking, validation, and deterministic serialization. However, it also declares materially broader capabilities not mentioned in the description, especially database reconciliation and index management, which go beyond a narrowly described '.md interchange library' foundation. Because the declared description omits these significant exported behaviors, the description does not fully accurately represent what the code exposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad shared interchange library centered on Markdown file IO/integrity features such as atomic writes, deterministic serialization, YAML frontmatter, advisory locking, and schema validation. The supplied code instead implements a narrow reconciliation function that detects drift between a database-state map and parsed file records by comparing IDs and hashes. That behavior is related at a high level to interchange data management, but it does not demonstrate the specific declared capabilities and has a materially different immediate purpose: sync/reconciliation analysis rather than foundational .md interchange operations. Because the code’s actual functionality is not accurately represented by the declared description, this is a mismatch.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

js-yaml is a direct production dependency of this package, and the advisories describe CPU exhaustion conditions during parsing of crafted YAML inputs. Because this skill is an interchange library centered on YAML frontmatter, untrusted Markdown/YAML content is core to its function, which makes parser-level denial of service materially relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package allows installation of js-yaml 4.1.1, which is flagged with multiple denial-of-service advisories involving YAML parsing and merge-key processing. Because this library explicitly advertises YAML frontmatter and schema validation as core functionality, vulnerable YAML parsing is directly relevant and could let crafted input consume excessive CPU or otherwise destabilize consumers of the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The API exposes a skipValidation option that allows callers to bypass frontmatter schema checks entirely. In a shared interchange library that other skills build on, this weakens a central trust boundary and can let malformed or policy-violating metadata be persisted, which may later trigger unsafe behavior in downstream consumers that assume validated input.

Content

Scanner excerpt · src/io.js (reported line 59)May include surrounding context.

js

* @param {string} filePath - Target file path
 * @param {Record<string, any>} frontmatter - Frontmatter fields
 * @param {string} content - Markdown body content
 * @param {{ force?: boolean, skipValidation?: boolean }} [opts] - Options; force=true skips idempotency check, skipValidation=true skips frontmatter validation
 */
export async function writeMd(filePath, frontmatter, content, opts = {}) {
  const lock = await acquireLock(filePath);

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This conditional explicitly disables validation when opts.skipValidation is set, creating a straightforward validation-bypass path. Because this module is the foundational I/O layer for other OpenClaw skills, allowing invalid YAML/frontmatter to be written here can propagate tainted state across the ecosystem and undermine assumptions made by higher-level logic.

Content

Scanner excerpt · src/io.js (reported line 86)May include surrounding context.

js

};

    // Validate frontmatter unless explicitly skipped (e.g., internal/test use)
    if (!opts.skipValidation) {
      const validation = validateFrontmatter(meta);
      if (!validation.valid) {
        throw new Error(`Invalid frontmatter: ${validation.errors.join('; ')}`);

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · test/interchange.test.js (reported line 86)May include surrounding context.

js

await expect(writeMd(fp, { skill: 'test' }, 'content')).rejects.toThrow(/Invalid frontmatter/);
  });

  it('allows skipValidation for internal use', async () => {
    const fp = path.join(tmpDir, 'skip.md');
    await writeMd(fp, { skill: 'test' }, 'content', { skipValidation: true });
    expect(readMd(fp).meta.skill).toBe('test');

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · test/interchange.test.js (reported line 88)May include surrounding context.

js

await expect(writeMd(fp, { skill: 'test' }, 'content')).rejects.toThrow(/Invalid frontmatter/);
  });

  it('allows skipValidation for internal use', async () => {
    const fp = path.join(tmpDir, 'skip.md');
    await writeMd(fp, { skill: 'test' }, 'content', { skipValidation: true });
    expect(readMd(fp).meta.skill).toBe('test');

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file describes atomic file I/O and presents the library as a foundation for reading and writing interchange files, but it does not include any caution that using the write APIs will modify files on disk. Because markdown files should warn about behaviors that could affect user data or system integrity, the omission is a minor safety disclosure gap.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @vitest/mocker==3.2.4 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"test:watch": "vitest"
  },
  "dependencies": {
    "js-yaml": "^4.1.0"
  },
  "devDependencies": {
    "vitest": "^3.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"js-yaml": "^4.1.0"
  },
  "devDependencies": {
    "vitest": "^3.0.0"
  },
  "engines": {
    "node": ">=18"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code forces the locale to 'en-US' and the currency to 'USD' in a user-facing formatter. This is a natural-language/locale policy concern because it imposes a specific locale and regional format without any opt-in or indication that the skill is intentionally US-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.