graph

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill is understandable and mostly scoped, but it bootstraps an unpinned external npm package that can execute changing code before the reviewed runtime exists.

Review the `graph-skill` npm package and pin a trusted exact version before use. Run the bootstrap only in a sandboxed workspace without unnecessary secrets, and inspect the generated `.graph/graph.py` before allowing it to manage retries, caches, reports, or commits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: Medium

Complete Code Snippet:

markdown

If `.graph/graph.py` is missing from the workspace, bootstrap the shared runtime first with `npx graph-skill install --target openclaw`.

Technical Analysis

The bootstrap instruction invokes npx graph-skill without an exact package version, integrity hash, lockfile constraint, or trusted-registry requirement. If the package is not already available locally, npx may retrieve the current registry version and execute its package entry point.

The retrieved installer is expected to create .graph/graph.py, which the remaining workflow trusts and invokes for initialization, caching, quality checks, retries, reporting, commits, and other operations. Because neither the npm package nor the generated Python runtime is included in the audited project, their effective behavior cannot be verified from the supplied files and may change after this review.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

1. An attacker compromises the graph-skill npm package, its publisher account, or the package distribution path, or causes an unsafe package version to be resolved.
2. The agent encounters a workspace without .graph/graph.py.
3. Following the Skill instruction, the agent runs:

   sh

   npx graph-skill install --target openclaw
   

4. npx downloads and executes the externally controlled package version.
5. The package executes code with the privileges and accessible environment of the agent process and may install a modified .graph/graph.py.
6. Subsequent workflow commands execute the installed runtime, extending the opportunity for malicious actions.

Impact Assessment

Successful exploitation could permit arbitrary code execution und ...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable version instead of resolving the latest package:

   sh

   npx --yes graph-skill@<audited-exact-version> install --target openclaw
   

2. Validate package integrity using an approved lockfile, checksum, signed provenance, or registry integrity metadata before execution.
3. Restrict installation to a trusted npm registry and disable unexpected registry or package-manager configuration overrides.
4. Prefer bundling the audited runtime with the Skill so installation does not retrieve executable code dynamically.
5. Review and verify the generated .graph/graph.py before invoking it, including its hash and expected file ownership and permissions.
6. Run bootstrap code in a sandbox with minimal filesystem access, no unnecessary secrets, restricted network access, and no elevated privileges.
7. Establish an update process in which new package versions and generated runtime changes are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs the agent to bootstrap code by running npx graph-skill install without pinning an exact package version or integrity value. That allows the fetched package to change over time or be replaced through upstream compromise, causing arbitrary code execution on the local system when the skill is used.

Content

No source excerpt is available for this finding.