GSD Pi (→ gsd-orchestrator)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill mostly acts as a redirect, but its install metadata can still install an external Node package that is not needed for a name-reservation skill.

Review this skill before installing. Its written content is only a redirect, but installation metadata may fetch and install an external Node package; prefer installing gsd-orchestrator directly unless you specifically trust and need the gsd-pi package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned and Mismatched Node Package Installation Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-15
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      bins: [gsd]
    install:
      kind: node
      package: gsd-pi
      bins: [gsd]

Technical Analysis

The skill metadata specifies installation of the Node package gsd-pi without an exact version, integrity hash, or verified source. The document otherwise states that this skill is only a name reservation and recommends installing gsd-orchestrator, creating a mismatch between the declared purpose and the package selected by its installation metadata.

If the hosting platform processes this metadata during installation, dependency resolution may retrieve the current externally controlled release of gsd-pi. Its contents can change after this skill has been audited. Node packages may also define lifecycle scripts that execute during installation. Therefore, compromise of the package publisher, registry account, or a later package release could turn skill installation into a code-execution channel.

The repository itself does not contain evidence that the referenced package is currently malicious. The confirmed weakness is reliance on an unpinned external package whose integrity is not constrained.

Attack Path

1. An attacker compromises the gsd-pi package publisher or otherwise gains the ability to publish a malicious release under that package name.
2. The attacker publishes a release containing a malicious lifecycle script or a malicious gsd executable.
3. A user or automation system installs the skill and processes its Node installation metadata.
4. The package manager resolves the unpinned dependency to the attacker-controlled release.
5. Malicious lifecycle code executes during installation, or the substituted gsd binary executes when subsequently i ...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the Node installation metadata from this reservation-only skill if it is not required for its documented purpose.
2. If a package must be installed, ensure that the package name matches the documented and reviewed skill.
3. Pin the dependency to an audited exact version rather than allowing unconstrained resolution.
4. Enforce package integrity verification using a trusted lockfile, checksum, signature, or equivalent mechanism supported by the installation platform.
5. Restrict dependency retrieval to an approved registry and verify package ownership and provenance.
6. Disable package lifecycle scripts where operationally possible, or review and sandbox them before execution.
7. Run installation and the resulting executable with least privilege and without unnecessary access to credentials or sensitive project data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.