Sequence

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:21 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Sequence finance integration guide that can access business banking data and propose transfers, with human approval controls described.

Install only if you intend to connect an agent to your Sequence business finance account. Review the plugin capabilities during setup, prefer read-only list/get tools unless you need transfer proposals, and remember that transfer actions should be checked in Sequence before approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned External Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–54
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

markdown

**OpenClaw** — install the Sequence plugin, which brings the connection with it:

```bash
openclaw plugins install clawhub:@getsequence/sequence
openclaw gateway restart

text

### Technical Analysis

The documented installation command retrieves an executable plugin from the external ClawHub registry without specifying an immutable version, cryptographic digest, or signature requirement. The plugin's implementation and dependency lockfiles are not included in the audited project, so its behavior and transitive dependency chain cannot be independently verified from the available artifact.

Because the package reference is mutable, the code installed by a user may differ from the code that existed when this skill was reviewed. Restarting the OpenClaw gateway subsequently loads the downloaded plugin. The surrounding documentation correctly warns users to inspect requested capabilities, but capability approval does not establish the integrity of the downloaded implementation.

### Attack Path

1. An attacker compromises the plugin publisher account, registry infrastructure, release pipeline, or a dependency used by the plugin.
2. The attacker publishes a malicious version under the existing `@getsequence/sequence` package identity.
3. A user follows the documented unpinned installation command.
4. OpenClaw resolves and downloads the attacker-controlled version.
5. The user approves the requested capabilities, potentially believing the package is the expected Sequence integration.
6. The user restarts the gateway, causing the downloaded plugin to load.
7. The malicious implementation abuses its granted capabilities to access authorized financial data, send it to an attacker-controlled destination, manipulate agent behavior, or create unauthorized
...[truncated 1192 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation command to a specifically reviewed plugin version rather than using a mutable package reference.
2. Where supported, pin the package by an immutable cryptographic digest and require signature or provenance verification before installation.
3. Publish or vendor the corresponding plugin source, dependency manifest, and lockfile so reviewers can audit the exact implementation being installed.
4. Document the expected publisher identity, package signature, checksum, version, and verification procedure.
5. Configure the plugin with least privilege. Enable only list* and get* tools for read-only use, and enable transfer-related tools only when explicitly required.
6. Avoid --accept-capabilities during interactive installation. In CI, explicitly enumerate and validate capabilities rather than approving an unrestricted or changing capability set.
7. Use controlled update procedures that review source changes, dependency changes, requested capabilities, and integrity metadata before deploying a new release.
8. Run the plugin in a sandbox with restricted filesystem, process, environment-variable, and outbound-network access where the platform supports such isolation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

When that happens:

- **Tell the user the transfer is proposed and needs their approval, and surface the `approvalUrl`.**
  Never tell them the money moved.
- **Do not call the tool again to force it through.** A retry creates a second pending approval; it
  does not execute the first. If it looks like it failed, check `listTransfers` before acting.
- Nothing moves until a human approves. An unapproved request auto-denies after 24 hours.

Static analysis

No suspicious patterns detected.