ClawHub
Back to skill

Security audit

GSD Agent (→ gsd-orchestrator)

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly redirects users to another skill, but it also declares an unpinned Node package install that is not explained by that redirect-only purpose.

Review this before installing. The skill text says to install gsd-orchestrator instead, so installing this placeholder may unnecessarily install the gsd-pi Node package. Prefer the real gsd-orchestrator skill unless you specifically trust and need the gsd-pi package installed by this placeholder.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:3
Finding

Unpinned and Unnecessary Node.js Dependency in a Redirect-Only Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3–15
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

yaml
description: >
  Redirect — install `gsd-orchestrator` instead.
  This skill exists to reserve the name. The full orchestration skill
  with subprocess patterns, exit code handling, and HeadlessJsonResult
  documentation lives at `gsd-orchestrator`.
metadata:
  openclaw:
    requires:
      bins: [gsd]
    install:
      kind: node
      package: gsd-pi
      bins: [gsd]

Technical Analysis

The skill describes itself as a name reservation whose only purpose is to redirect users to gsd-orchestrator. Nevertheless, its metadata declares the gsd-pi Node.js package as an installation dependency and requires the resulting gsd executable.

No version or integrity constraint is specified for gsd-pi. Consequently, package resolution may retrieve whichever release is current at installation time rather than a specifically reviewed artifact. This creates a supply-chain risk because the installed package can change independently of the audited skill. Node.js package installation may also invoke package lifecycle scripts, depending on the package and package-manager configuration.

The declared dependency is especially concerning because the redirect-only content does not demonstrate a functional need for the executable. This unnecessarily expands the skill's trusted computing base and installation-time attack surface. The audit did not establish that the current gsd-pi package is malicious; the finding concerns the unsafe, unpinned, and apparently unnecessary dependency declaration.

Attack Path

  1. A user installs or activates the placeholder skill.
  2. The host processes the metadata.openclaw.install declaration.
  3. The package manager resolves the unversioned gsd-pi package from its configured registry.

...[truncated 1071 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the requires and install metadata from this placeholder skill because its documented purpose is only to redirect users.
  2. If gsd-pi is genuinely required, document the exact functionality that depends on it.
  3. Pin the dependency to a specifically reviewed version rather than allowing unconstrained resolution.
  4. Enforce package integrity verification through a trusted lockfile, integrity hash, or equivalent package-management control.
  5. Audit the package, its transitive dependencies, and any lifecycle scripts before publication.
  6. Disable package lifecycle scripts during installation where operationally feasible.
  7. Install dependencies using a least-privileged account and isolate installation from sensitive credentials and production data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.