kiwi-buyer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed procurement assistant that relies on an external Kiwi plugin, with user-confirmation safeguards before approval actions.

Before installing, confirm that you trust the clawhub:kiwi plugin publisher and understand that this skill can help negotiate and approve procurement agreements through that plugin. Keep the user-confirmation step for approvals in place, and avoid enabling automatic approval flows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned and Unauditable External Plugin Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party plugin dependency
Risk Level: Medium

Vulnerable Code Snippet

text

openclaw plugins install clawhub:kiwi

Technical Analysis

The skill directs users to install the external clawhub:kiwi plugin without specifying an immutable version, integrity digest, or other mechanism for verifying its contents. All kiwi_buyer_* tools used by the skill are provided by this dependency, but the plugin implementation is not included in the audited project.

Consequently, the effective functionality executed by the skill is determined by the package currently published under that registry identifier. Its contents could change after this skill has been reviewed. If the registry account, distribution infrastructure, or package is compromised, users could receive malicious code while following the documented installation process.

This finding does not establish that the current plugin is malicious. It identifies a supply-chain trust weakness because the dependency cannot be reproduced or independently audited from the submitted project.

Attack Path

1. An attacker compromises the plugin publisher account, registry entry, or package distribution infrastructure.
2. The attacker publishes a modified package under the existing clawhub:kiwi identifier.
3. A user follows the instruction in SKILL.md and installs the plugin without a version or integrity check.
4. The host loads the attacker-controlled plugin as the implementation of the trusted kiwi_buyer_* tools.
5. When the purchasing workflow invokes those tools, the modified plugin executes with the permissions available to the plugin runtime.

Impact Assessment

The precise impact cannot be established because the plugin source and runtime permission model were not present in the audited project. A compromised dependency could potentially access procur ...[truncated 621 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than installing the mutable clawhub:kiwi package identifier.
2. Require an immutable cryptographic digest or signed package manifest and verify it before installation.
3. Document the authoritative publisher, source repository, release version, and expected integrity value.
4. Include or vendor the plugin implementation in the review scope where licensing and deployment constraints permit.
5. Use a trusted package registry with publisher verification, signed releases, access controls, and audit logs.
6. Run the plugin with least privilege, restricting filesystem access, credentials, network destinations, and access to unrelated tools.
7. Require explicit user confirmation before installing or updating the dependency, and clearly disclose the permissions it requests.
8. Establish a controlled update process in which new plugin releases are reviewed and their integrity values are approved before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep