Back to plugin

Security audit

Code Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a high-authority coding-agent orchestrator with disclosed purpose, but it includes broad activation, autonomous workflows, self-update/restart behavior, and repository-changing actions that warrant careful review.

Install only if you are comfortable giving this skill authority to run or resume coding agents, manage worktrees, persist sessions, and potentially open PRs. Review its approval model, disable auto-approval or auto-PR unless needed, restrict it to trusted repositories, and treat self-update/restart behavior as an administrator-level capability.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The plugin implements self-update and gateway restart flows that can reinstall the package and trigger a service restart from interactive actions. Even though there is some version verification, this materially expands the skill's authority from orchestration into code replacement and control-plane disruption, which is dangerous for a skill whose purpose does not inherently require self-modification.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The README documents plain-text control words like 'Approve', 'Revise', and 'Reject' in the same chat thread as valid plan-control actions. In a chat-orchestrated agent system, broad natural-language triggers can be invoked accidentally, quoted by another user, or replayed out of context, causing unintended plan approval or workflow state changes.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill declares broad activation around generic phrases like 'let oca do...', 'ask oca to...', or 'have oca handle...', which can overlap with ordinary conversational requests rather than an explicitly scoped tool invocation. In an orchestration skill that can launch background coding agents with permission bypass or worktree actions, ambiguous triggering increases the chance of unintended activation and delegation of sensitive work.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The guidance reinforces ambiguous trigger handling by instructing the system to treat casual phrases as requests to invoke the orchestration layer, without clear constraints on when that interpretation is valid. Because this skill can resume sessions, approve plans, and manage worktrees, mistaken invocation could cause unintended code changes or workflow actions in the wrong repository or context.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`)}function Us(t){if(t)return{phase:t.phase,awaitingInput:t.isAwaitingInput??!!t.pendingInputState,latestOutput:Th(t.getOutput(20))}}function Ks(t,e,n){let r=t.loopMode??"verifier",o=[`${t.name} [${t.id}]`,`  Status: ${t.status}`,...r==="ralph"?["  Loop mode: ralph",`  Iteration: ${t.iteration}/${t.maxIterations}`]:[`  Repair iteration: ${t.iteration}/${t.maxIterations}`],`  Workdir: ${t.workdir}`];return r==="ralph"&&t.completionPromise&&o.push(`  Completion promise: ${t.completionPromise}`),t.sessionId&&o.push(`  Session: ${t.sessionName??"(unknown)"} [${t.sessionId}]`),e?.phase&&o.push(`  Phase: ${e.phase}`),e?.awaitingInput!==void 0&&o.push(`  Awaiting input: ${e.awaitingInput?"yes":"no"}`),n&&o.push(...qs(n,"  ")),t.lastVerifierSummary&&(o.push("  Last verifier:"),o.push(...qs(t.lastVerifierSummary,"    "))),e?.latestOutput&&(o.push("  Latest activity:"),o.push(...qs(e.latestOutput,"    "))),t.waitingForUserReason&&o.push(`  Waiting on user: ${t.waitingForUserReason}`),t.failureReason&&o.push(`  Failure: ${t.failureReason}`),o.join(`
`)}var Me="Error: GoalController not initialized. The code-agent service must be running.";function Ro(t,e,n){let r=n?.trim();if(r){let i=t.getTask(r);if(!i)return`Error: Goal task "${r}" not found.`;let s=i.sessionId?e(i.sessionId):void 0;return Ks(i,Us(s))}let o=t.listTasks();return o.length===0?"No goal tasks found.":o.map(i=>{let s=i.sessionId?e(i.sessionId):void 0;return Ks(i,Us(s))}).join(`

`)}function Ao(t,e){return t?t.action==="already_terminal"?`Task is already ${t.task.status}.`:`Task "${t.task.name}" (${t.task.id}) stopped.`:`Error: Goal task "${e}" not found.`}function Io(t,e){switch(t.action){case"updated":return`Task "${t.task.name}" (${t.task.id}) goal updated.`;case"not_found":return`Error: Goal task "${e}" not found.`;case"invalid_goal":return"Error: replacement goal must not be empty.";case"not_editable":return t.task.status!=="waiting_for_user"?`Task is already ${t.task.status}.`:`Error: Goal task "${t.task.nam
...[truncated 27 chars]
Confidence
91% confidence
Finding
without asking

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### `planApproval: "approve"`

- Auto-approve only after verification per the session policy.

## Worktree Decisions
Confidence
80% confidence
Finding
Auto-approve

Self-Modification

High
Category
Rogue Agent
Content
(This tool cannot automatically reopen or recreate PRs to avoid unintended actions.)`}],meta:{success:!1,state:"closed"}};{if(w?.policy==="never-pr")return{content:[{type:"text",text:`Error: Repo policy forbids PR creation for ${w.identity?.repoRoot??d}.`}],meta:{success:!1,state:"error"}};let R=!r.title||!r.body?Qe(d,u,m):void 0,_;if(!r.title||!r.body){let z=await qn({sessionName:l,branchName:u,prompt:o.prompt,outputPreview:o.outputPreview,diffSummary:R,provider:c});if(z.ok===!1)return{content:[{type:"text",text:`❌ ${z.error}`}],meta:{success:!1,state:"error"}};_=z.metadata}let q=r.title??_.title,N=r.body;N||(N=Un({sessionName:l,metadata:_,diffSummary:R}));let F=ll(d,u,m,q,N,f,{draft:!0});if(F.success&&F.prUrl){let z=Re(d,u,f);k({prUrl:F.prUrl,prNumber:z.number,targetRepo:f,disposition:"pr-opened"});let J=Rt({kind:"pr-opened",branch:u,targetRepo:f,prUrl:F.prUrl});return v.notifyWorktreeOutcome(o.notificationTarget,J,{completionWakeOutcomeKey:Fs({action:"opened",branchName:u,prUrl:F.prUrl,prNumber:z.number,targetRepo:f}),detailLines:Ls({action:"opened",branchName:u,baseBranch:m,prUrl:F.prUrl,prNumber:z.number,targetRepo:f})}),{content:[{type:"text",text:F.warnings&&F.warnings.length>0?`${J}

⚠️  ${F.warnings.join("; ")}`:J}],meta:{success:!0,state:"created"}}}else return{content:[{type:"text",text:`❌ Failed to create PR: ${F.error??"unknown error"}`}],meta:{success:!1,state:"error"}}}}}}}var vo=Q(()=>{se();V();Ae();Ns();On();Wn();Ns()});import{readdirSync as yv,statSync as kv,rmSync as Sv}from"fs";import{execFileSync as vv}from"child_process";import{join as va}from"path";var ba={name:"openclaw-code-agent",version:"4.7.6",type:"module",packageManager:"pnpm@11.13.0",main:"dist/index.js",scripts:{"audit:prod":"pnpm audit --prod",build:"esbuild index.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/index.js --minify --charset=utf8 --pure:console.log --pure:console.warn --pure:console.info --pure:console.debug --external:@anthropic-ai/claude-agent-
...[truncated 27 chars]
Confidence
98% confidence
Finding
self-update

Unpinned Dependencies

Low
Category
Supply Chain
Content
"LICENSE"
  ],
  "dependencies": {
    "@anthropic-ai/claude-agent-sdk": "^0.3.142"
  },
  "devDependencies": {
    "@types/node": "^26.0.1",
Confidence
94% confidence
Finding
"@anthropic-ai/claude-agent-sdk": "^0.3.142"

Tool Parameter Abuse

High
Category
Tool Misuse
Content
`)}var vn=Q(()=>{});function Kt(t){return{type:"backend_ref",ref:t}}function Vt(t){return{type:"run_started",...t?{runId:t}:{}}}function kt(t){return{type:"text_delta",text:t}}function lr(t,e){return{type:"tool_call",name:t,input:e}}function Be(t){return{type:"pending_input",state:t}}function dt(t){return t?{type:"pending_input_resolved",requestId:t}:{type:"pending_input_resolved"}}function ur(t,e){return{type:"plan_artifact",artifact:t,finalized:e}}function jt(t){return t?{type:"settings_changed",permissionMode:t}:{type:"settings_changed"}}function Ge(t){return{type:"run_completed",data:t}}var at,cr=Q(()=>{at=class{queue=[];resolvePending=null;done=!1;enqueue(e){this.queue.push(e),this.flush()}close(){this.done=!0,this.flush()}flush(){this.resolvePending&&(this.resolvePending(),this.resolvePending=null)}messages(){let e=this;return(async function*(){for(;;){for(;e.queue.length>0;)yield e.queue.shift();if(e.done)return;await new Promise(n=>{e.resolvePending=n})}})()}}});import*as mr from"@anthropic-ai/claude-agent-sdk";function om(t){if(typeof t.result=="string"&&t.result.length>0)return t.result;if(Array.isArray(t.errors)){let e=t.errors.filter(n=>typeof n=="string"&&n.length>0);if(e.length>0)return e.join(`
`)}}function im(t,e,n){let r=Ut(n),o=r.length>0?0:void 0,i=o!=null?r[o]:void 0,s=i?.options.map(d=>d.label)??[],a=i?je(i,o,r.length):dr(r);return{requestId:`${t||"claude"}-ask-${e}`,kind:"question",promptText:a,options:s,...r.length>0?{questions:r}:{},...o!=null?{activeQuestionIndex:o}:{},allowsFreeText:i?.allowsFreeText===!0||s.length===0}}var pr,Qa=Q(()=>{vn();cr();pr=class{constructor(e={}){this.deps=e}deps;name="claude-code";backendKind="claude-code";supportedPermissionModes=["default","plan","bypassPermissions"];capabilities={nativePendingInput:!1,nativePlanArtifacts:!1,worktrees:"plugin-managed"};launch(e){let n=new at,r=!1,o="",i=!1,s=0,a=e.resumeSessionId??"",d=e.canUseTool,l={cwd:e.cwd,model:e.model,...e.reasoningEffort?{effort:e.reasoningEffort}:{},pe
...[truncated 27 chars]
Confidence
84% confidence
Finding
Rm="OPENCLAW_CODEX_APP_SERVER_TIMEOUT_MS",Am=/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
`):av(t);return n?o:o.length>e?Vc(t)?Ed(o,e):Dd(o,e):o}function av(t){let e=typeof t.getOutput=="function"?t.getOutput():[],n=e.join(`
`).trim();return n?Vc(t)?dv(n)??n:e.slice(-20).join(`
`):""}function Vc(t){if(t.status==="completed"||t.killReason==="done")return!0;let e=t;return e.approvalState==="approved"||e.planModeApproved===!0||(e.planDecisionVersion??0)>0}function dv(t){let n=t.split(/\n\s*\n+/).map(r=>r.trim()).filter(r=>/[A-Za-z0-9]/.test(r)).at(-1);if(n)return n.length>=120||n.includes(`
`)?n:void 0}ke();Ae();ae();import{unlinkSync as lv}from"fs";var yi=class t{timers=new Map;disposed=!1;static MAX_DELAY_MS=2147483647;schedule(e,n,r){if(this.disposed||(this.cancel(e),!Number.isFinite(n)))return;let o=Math.max(0,n-Date.now()),i=setTimeout(()=>{if(this.timers.delete(e),!this.disposed){if(n-Date.now()>0){this.schedule(e,n,r);return}r()}},Math.min(o,t.MAX_DELAY_MS));i.unref?.(),this.timers.set(e,i)}cancel(e){let n=this.timers.get(e);n&&(clearTimeout(n),this.timers.delete(e))}cancelPrefix(e){for(let n of this.timers.keys())n.startsWith(e)&&this.cancel(n)}dispose(){this.disposed=!0;for(let e of this.timers.values())clearTimeout(e);this.timers.clear()}};ne();Mn();Ae();var jc=10080*60*1e3,uv=300*1e3,Gc="tmp-output:cleanup",cv=60*1e3;function pv(t){return t instanceof Error?t.message:String(t)}var ki=class{constructor(e){this.deps=e}deps;scheduler=new yi;lastTmpOutputCleanupAttemptAt;schedule(e,n,r){this.scheduler.schedule(e,n,r)}cancel(e){this.scheduler.cancel(e)}cancelPrefix(e){this.scheduler.cancelPrefix(e)}bootstrapMaintenanceSchedules(){let e=Date.now();this.runTmpOutputCleanup(e);for(let n of this.deps.store.listPersistedSessions())this.syncPersistedSessionMaintenance(n);this.syncActionTokenExpiryDeadline(),this.deps.store.cleanupOrphanOutputFiles(),this.syncTmpOutputCleanupDeadline(e)}syncRuntimeGcDeadline(e){if(!e.completedAt)return;let n=this.runtimeGcKey(e.id);this.schedule(n,e.completedAt+this.runtimeGcMaxAgeMs(),()=>{let r=this.deps.sessions.get(e.id)
...[truncated 27 chars]
Confidence
88% confidence
Finding
execute("auto-pr",{session:y.id,base_branch:w}))?.meta?.success===!0}}}),h=new di(e.pendingAskUserQuestions,(y,w)=>e.dispatchSessionNotification(y,w),y=>{e.clearWaitingTimestampsForSession(y)},(y,w,B)

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
`));return}e.iteration+=1;let k=xy(e,c),f=bo({output:s,verifierSummary:c.summary,completionPromise:a,completionDetected:!0});try{let p=await this.resumeTaskSession(e,k,n);this.setTaskRunningWithSession(e,p),this.notifyIterationStatus(e,`🔁 [${e.name}] Completion claimed but verifiers still failed`,void 0,f),this.scheduleTaskEvaluation(e.id,"ralph-verifier-resume",p.id)}catch(p){this.markTaskFailed(e,`Failed to resume the Ralph goal task after verifier failure: ${_t(p)}`)}return}let l=by(s);if(e.lastVerifierFingerprint===l?e.repeatedFailureCount+=1:e.repeatedFailureCount=1,e.lastVerifierFingerprint=l,e.iteration+1>=e.maxIterations){this.markTaskFailed(e,[`Completion promise "${a}" was not emitted before hitting the iteration budget (${e.maxIterations}).`,"Latest output:",pt(s,20)||"(no output)"].join(`
`));return}e.iteration+=1;let u=Iy(e,s),m=bo({output:s,completionPromise:a,completionDetected:!1});try{let c=await this.resumeTaskSession(e,u,n);this.setTaskRunningWithSession(e,c),this.notifyIterationStatus(e,`🔁 [${e.name}] Continued`,void 0,m),this.scheduleTaskEvaluation(e.id,"ralph-continue",c.id)}catch(c){this.markTaskFailed(e,`Failed to continue the Ralph goal task: ${_t(c)}`)}return}let r=await this.runVerifiers(e);if(e.lastVerifierSummary=r.summary,e.updatedAt=Date.now(),r.status==="pass"){this.markTaskSucceeded(e,r.summary);return}if(e.lastVerifierFingerprint===r.fingerprint?e.repeatedFailureCount+=1:e.repeatedFailureCount=1,e.lastVerifierFingerprint=r.fingerprint,e.iteration+1>=e.maxIterations){this.markTaskFailed(e,[`Verifier did not pass before hitting the iteration budget (${e.maxIterations}).`,r.summary].join(`
`));return}e.iteration+=1;let o=Ay(e,r),i=bo({verifierSummary:r.summary});try{let s=await this.resumeTaskSession(e,o,n);this.setTaskRunningWithSession(e,s),this.notifyIterationStatus(e,`🔁 [${e.name}] Repair iteration started after verifier failure`,void 0,i),this.scheduleTaskEvaluation(e.id,"repair-resume",s.id)}catch(s){this.markTaskFailed(e,`Fai
...[truncated 27 chars]
Confidence
89% confidence
Finding
git reset --hard; without asking; Do not ask; Do not ask; Do not ask; Do not ask; Do not ask; Do not ask; Do not ask; do not ask; do not ask; do not ask

VirusTotal

44/44 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dist/index.js:282
Evidence
`)?n:void 0}ke();Ae();ae();import{unlinkSync as lv}from"fs";var yi=class t{timers=new Map;disposed=!1;static MAX_DELAY_MS=2147483647;schedule(e,n,r){if(this.dis...

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/index.js:6
Evidence
${S.text}`:S.text,n.enqueue(kt(S.text));continue}S.type==="tool_use"&&((S.name==="ExitPlanMode"||S.name==="set_permission_mode")&&(i=!0),S.name!=="AskUserQuesti...