Package Manager Updates

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This package-update skill is coherent, but its broad update commands can change many installed tools and do not clearly enforce the stated OpenClaw exclusion or validate package names before shell use.

Review the exact packages before allowing updates. Prefer selecting individual packages from trusted package-manager output, avoid running all-update commands when OpenClaw or system-critical packages may be installed, and do not approve commands containing untrusted package names, shell metacharacters, spaces, redirects, or option-like names.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Unvalidated Package and Module Names Permit Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-77
Vulnerability Type: Shell command injection through unvalidated command parameters
Risk Level: High

The vulnerable command templates are:

bash

npm install -g <package-name>@latest

pip install --upgrade <package-name>

brew upgrade <package-name>

go get -u <module>

Technical Analysis

The skill instructs the agent to substitute user-selected package or module names directly into shell commands. It does not require validation, shell escaping, quoting, rejection of option-like input, or use of argument-array execution APIs.

If attacker-controlled text is substituted into one of these placeholders and passed to a shell, metacharacters such as command separators, command substitutions, or redirection operators may be interpreted as shell syntax rather than as part of a package name. A leading hyphen may also be treated as a package-manager option and change command behavior.

Although updates require explicit user confirmation, that confirmation does not eliminate the flaw if the displayed package identifier conceals or includes malicious shell syntax.

Attack Path

1. An attacker causes a crafted value to be used as a package or module name, such as through a user request, copied update list, or untrusted package metadata.
2. The agent inserts the value directly into one of the documented command templates.
3. The user confirms the update without recognizing the embedded shell syntax.
4. The command is executed through a shell.
5. The shell interprets the malicious portion as an additional command or altered command-line option.
6. The injected operation runs with the same privileges and environment access as the agent process.

Impact Assessment

Successful exploitation can execute arbitrary commands with the privileges of the agent or invoking user. This may permit modification or deletion of acc ...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate every package or module identifier against the grammar supported by its package manager. Reject shell metacharacters, whitespace, control characters, redirection operators, and unexpected URL or path forms.
2. Reject identifiers beginning with - unless the relevant package manager explicitly supports and safely handles them.
3. Do not construct shell command strings. Invoke executables through an API that accepts an argument array, for example ["npm", "install", "-g", package + "@latest"].
4. Where supported, insert an end-of-options delimiter (--) before user-controlled positional arguments.
5. Resolve package selections from structured output produced by the corresponding package manager rather than accepting arbitrary free-form values.
6. Display the exact executable and argument list to the user before execution and require confirmation for that precise command.
7. Run updates with the minimum necessary privileges and avoid administrator or root execution unless separately justified and confirmed.
8. Add explicit instructions that package metadata and user-provided identifiers must be treated as untrusted input.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that OpenClaw packages must always be excluded, but the update commands are broad bulk-update operations and do not implement any filtering or pre-checks to enforce that rule. In a package-management skill, this mismatch is dangerous because an agent following the documented commands could still update excluded packages, violating policy and potentially changing sensitive or incompatible dependencies.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.