Graphviz

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for Graphviz rendering, but it tells agents to download and run an unverified WebAssembly file from a mutable third-party GitHub URL.

Review this skill before installing. Its core function is understandable, but it should ideally bundle the reviewed WASM file or pin it to an immutable version with a published SHA-256 or signature check. Also consider narrowing activation to explicit Graphviz or DOT-to-SVG requests.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23

Finding

Mutable Remote WebAssembly Payload Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–42
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

markdown

- **Required plugin:** `openclaw-wasm-sandbox`
- **WASM file:** `~/.openclaw/skills/graphviz/files/graphviz_component.wasm` (Use the `wasm-sandbox-download` tool to download，URL: `https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/graphviz/files/graphviz_component.wasm`)

## How It Works

The WASM component:
- Accepts DOT graph string as **argument**
- Outputs SVG to **stdout**

## Tool

Use `wasm-sandbox-run` tool:

| Parameter | Value |
|-----------|-------|
| `wasmFile` | `~/.openclaw/skills/graphviz/files/graphviz_component.wasm` |
| `args` | DOT graph string, e.g. `["digraph { a -> b }"]` |

```javascript
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/graphviz/files/graphviz_component.wasm",
  args: ["digraph { a -> b }"]
})

text

### Technical Analysis

The skill directs the agent to download a WebAssembly executable from a third-party personal GitHub repository and subsequently execute that file through `wasm-sandbox-run`. The URL references the mutable `main` branch rather than an immutable commit or versioned release.

No expected cryptographic digest, signature, immutable revision, or other integrity-verification mechanism is specified. Consequently, the code executed by the agent can differ from the artifact that was originally reviewed. This creates a remote payload substitution and supply-chain risk if the repository owner changes the file, the repository or account is compromised, or the upstream artifact is otherwise replaced.

Execution inside a WASM sandbox may reduce the payload's available privileges, but it does not establish the payload's authenticity. It also does not eliminate denial-of-service behavior, malicious output, abuse of capabilities intentionally exposed by the pl
...[truncated 1669 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the reviewed graphviz_component.wasm artifact directly in the skill package rather than downloading executable content at runtime.
2. If remote retrieval is unavoidable, reference an immutable Git commit or cryptographically versioned release instead of the mutable main branch.
3. Publish an expected SHA-256 or stronger cryptographic digest in the reviewed skill and verify the downloaded bytes before execution. Abort execution if verification fails.
4. Require a cryptographically signed release and validate the signature against a pinned, trusted public key.
5. Pin and audit the exact version of openclaw-wasm-sandbox, and document all host capabilities made available to WASM components.
6. Configure the sandbox with strict CPU, memory, execution-time, output-size, filesystem, and network limits. Expose no host interfaces beyond those required to transform DOT input into SVG output.
7. Treat downloaded artifacts as untrusted until all integrity and authenticity checks complete, and do not overwrite a previously verified local artifact on verification failure.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger section includes broad generic terms such as "SVG" and "flowchart," plus multilingual keyword lists, which can cause the skill to activate for requests that are not specifically about Graphviz DOT rendering. Over-broad routing is a real security concern because it increases unintended invocation of a tool that processes user-supplied input, expanding the attack surface and potentially interfering with safer or more appropriate skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.