ClawHub
Back to skill

Security audit

Reading Notes Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local reading-note formatter with no artifact-backed evidence of data theft, persistence, or unsafe hidden behavior, though its dependency documentation should be clearer.

Before installing, understand that the note processing code appears local-only, but a source install using npm will resolve third-party packages dynamically unless the publisher adds a lockfile or pins versions. Prefer installing through a trusted ClawHub release path or in a low-privilege environment, and treat the 'No External Dependencies' claim as meaning no external note-processing APIs, not no npm dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:37
Finding

Unpinned Dependencies and Missing Lockfile Create Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · dist/index.js (reported line 84)May include surrounding context.

js
`What are the limitations or counterarguments to consider?`,
        `How does this fit into a broader context or system?`
    ];
    return prompts.slice(0, 5); // Return top 5 prompts
}

/**

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/index.ts (reported line 111)May include surrounding context.

ts
`What are the limitations or counterarguments to consider?`,
        `How does this fit into a broader context or system?`
    ];
    return prompts.slice(0, 5); // Return top 5 prompts
}

/**

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The runtime dependency on openclaw is specified with a caret range, allowing newer compatible releases to be installed over time. This weakens build reproducibility and can silently introduce vulnerable or malicious upstream changes into the skill, which matters more for a framework package that executes the skill.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json
},
  "homepage": "https://github.com/harrylabs0913/openclaw-skill-reading-notes#readme",
  "dependencies": {
    "openclaw": "^2026.3.0"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",

Unverifiable Dependency: openclaw has 16 known advisory(ies) (CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest uses an unpinned openclaw version while the package has multiple known advisories, making it impossible to verify whether installed builds are affected. Because openclaw is the primary runtime framework for the skill, a vulnerable resolved version could materially affect execution security despite the skill claiming to be 'local only' and 'safe'.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json
"openclaw": "^2026.3.0"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@typescript-eslint/eslint-plugin": "^6.13.2",
    "@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@typescript-eslint/eslint-plugin": "^6.13.2",
    "@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",
    "eslint": "^8.55.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 42)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.10.0",
    "@typescript-eslint/eslint-plugin": "^6.13.2",
    "@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",
    "eslint": "^8.55.0",
    "jest": "^29.7.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
83% confidence
Finding

esbuild is unpinned and has known security history; allowing version drift in a build tool increases supply-chain exposure during local development and publishing. Although this is not part of normal runtime behavior, compromised build-time tooling can taint produced artifacts.

Content

Scanner excerpt · package.json (reported line 43)May include surrounding context.

json
"@types/node": "^20.10.0",
    "@typescript-eslint/eslint-plugin": "^6.13.2",
    "@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",
    "eslint": "^8.55.0",
    "jest": "^29.7.0",
    "prettier": "^3.1.0",

Unverifiable Dependency: esbuild has 2 known advisory(ies) (GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r); GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
78% confidence
Finding

esbuild has known advisories and is not pinned, so the build environment may resolve to an affected release. In this skill context it is less dangerous than a runtime library because it is used for bundling, but compromised build tooling can still expose developers or poison generated artifacts.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 44)May include surrounding context.

json
"@typescript-eslint/eslint-plugin": "^6.13.2",
    "@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",
    "eslint": "^8.55.0",
    "jest": "^29.7.0",
    "prettier": "^3.1.0",
    "ts-jest": "^29.1.1",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 45)May include surrounding context.

json
"@typescript-eslint/parser": "^6.13.2",
    "esbuild": "^0.19.8",
    "eslint": "^8.55.0",
    "jest": "^29.7.0",
    "prettier": "^3.1.0",
    "ts-jest": "^29.1.1",
    "typescript": "^5.3.2"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 46)May include surrounding context.

json
"esbuild": "^0.19.8",
    "eslint": "^8.55.0",
    "jest": "^29.7.0",
    "prettier": "^3.1.0",
    "ts-jest": "^29.1.1",
    "typescript": "^5.3.2"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 47)May include surrounding context.

json
"eslint": "^8.55.0",
    "jest": "^29.7.0",
    "prettier": "^3.1.0",
    "ts-jest": "^29.1.1",
    "typescript": "^5.3.2"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 48)May include surrounding context.

json
"jest": "^29.7.0",
    "prettier": "^3.1.0",
    "ts-jest": "^29.1.1",
    "typescript": "^5.3.2"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

No suspicious patterns detected.