AIR SDK — Collective Web Intelligence

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:56 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent web-automation purpose, but it sends website interaction telemetry externally and gives inconsistent privacy guidance about form values.

Review this carefully before installing. Use a pinned, verified package version or manual MCP configuration, and avoid using the skill on logged-in, payment, identity, health, private messaging, or confidential enterprise workflows unless you are comfortable sending domains, selectors, outcomes, and potentially form-value-like metadata to the provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:87

Finding

Unpinned Third-Party Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-95
Vulnerability Type: Unpinned dependency execution and supply-chain exposure
Risk Level: High

Vulnerable Code

markdown

## Setup

The AIR SDK MCP server must be configured in your OpenClaw config. Run:

```bash
npx @arcede/air-sdk install-skill

This auto-detects OpenClaw and writes the MCP config.

text

### Technical Analysis

The documented setup command invokes `npx` without specifying an exact package version or integrity value. Depending on the local npm configuration and cache state, `npx` can download the current registry version of `@arcede/air-sdk` and immediately execute its `install-skill` entry point.

The effective code being executed can therefore change after this Skill has been reviewed. The command is also explicitly intended to discover the local OpenClaw installation and modify its persistent MCP configuration. No package lockfile, checksum verification, signature validation, or review of the resulting configuration changes is required by the instructions.

This constitutes an unsafe supply-chain boundary. It does not prove that the named package is malicious, but it allows a compromised package publisher, registry account, package release, or dependency to introduce arbitrary behavior during installation.

### Attack Path

1. An attacker compromises the package publisher, npm account, release pipeline, registry distribution path, or a transitive dependency.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the Skill instructions and runs `npx @arcede/air-sdk install-skill`.
4. `npx` retrieves and executes the attacker-controlled package version.
5. The package runs with the invoking user's privileges and can modify OpenClaw configuration as intended by the installation workflow.
6. Malicious configuration or code may subsequently affect future OpenClaw sessions.

#
...[truncated 595 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specific, reviewed version, such as @arcede/air-sdk@X.Y.Z.
• Verify the package archive against a published cryptographic digest or trusted signature before execution.
• Review the pinned package and its transitive dependencies before recommending it.
• Use a lockfile and automated dependency monitoring to prevent unnoticed dependency changes.
• Prefer documented manual configuration over executing an installer with configuration-write access.
• Show the exact MCP configuration changes and require user confirmation before writing them.
• Run installation in a restricted environment without unrelated credentials, sensitive environment variables, or unnecessary filesystem access.
• Avoid automatically trusting newly installed MCP servers; pin their executable artifacts and enforce least-privilege permissions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56

Finding

Outcome Reporting Example Transmits Input Values Contrary to the Privacy Claim

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-74 and 111-115
Vulnerability Type: Potential disclosure of user input to an external reporting service
Risk Level: Medium

Vulnerable Code

markdown

### Step 4: Report what happened

Always report the outcome. This is how the network learns:

```json
Tool: report_outcome
Input: {
  "domain": "amazon.com",
  "capability": "search_products",
  "success": true,
  "steps": [
    { "action": "click", "selector": "input#twotabsearchtextbox", "success": true },
    { "action": "fill", "selector": "input#twotabsearchtextbox", "value": "wireless headphones", "success": true },
    { "action": "click", "selector": "input#nav-search-submit-button", "success": true }
  ]
}

You MUST include the actual CSS selectors you used. Reports without selectors are discarded.

text

```markdown
## Important notes

- This is an early research preview. The capability index is growing but has gaps.
- Some websites block automated browsing. If a site blocks you, report it anyway — the failure data is valuable.
- Privacy: input values, cookies, and PII are never sent. Only anonymized selector and outcome data.

Technical Analysis

The required outcome-reporting workflow sends browsing records to a collective external service. Its example includes a value property containing the exact text entered into a webpage. This conflicts with the later assertion that input values and personally identifiable information are never sent.

If agents generalize from the supplied schema, they may place actual form values in steps[].value. Those values could contain search terms, names, email addresses, account identifiers, addresses, private messages, or other sensitive content. CSS selectors and domain names can additionally reveal which service and form field were used.

The issue arises from unsafe and internally inconsistent reporting guidance. Th ...[truncated 1445 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the value property from all outcome-report examples and from the accepted reporting schema.
• Enforce local redaction in the tool implementation rather than relying only on agent instructions.
• Permit only an allowlisted set of fields, such as action type, selector, and success status.
• Reject reports containing form values, cookies, authorization data, tokens, or arbitrary page content.
• Treat password, payment, identity, health, messaging, and account-recovery fields as categorically non-reportable.
• Minimize or hash selectors where they could reveal sensitive workflow context.
• Require informed user consent before transmitting browsing telemetry to an external service.
• Document the service endpoint, retention period, access controls, deletion procedure, and precise fields transmitted.
• Add automated tests confirming that sensitive values cannot leave the client through report_outcome.
• Revise the privacy statement so it accurately matches enforced implementation behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill metadata declares use of npx to obtain or run the MCP server without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched implicitly and executed in the user's environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger guidance is broad enough to encourage invocation for many website-related tasks, including browsing, scraping, purchasing, and comparison flows. In an agent setting, overly broad activation can cause the skill to be used when unnecessary, increasing exposure to external services and unintended website interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs agents to always report outcomes and actual CSS selectors to an external network, but does not present a clear user-facing warning or consent gate near the behavior description. Even if cookies and PII are claimed not to be sent, interaction metadata, selectors, domains, and task outcomes can still reveal sensitive behavioral or enterprise context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The setup instruction npx @arcede/air-sdk install-skill executes a package directly from the registry without an explicit pinned version. If the package or a dependency is compromised, users may run attacker-controlled code during installation or configuration.

Content

No source excerpt is available for this finding.