Openclaw Akf

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.6.0

Overview

The skill mostly matches its trust-metadata purpose, but it asks users to install mutable external tools and documents a mode that can run commands embedded in files.

Install only if you trust the AKF package sources or can pin and verify the exact package versions. Treat `akf replay --run` as running code from the inspected file: review the exact command, get explicit approval, and use a sandbox without sensitive credentials for untrusted artifacts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–18 and 183–184
Vulnerability Type: Supply-chain exposure through mutable package references
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    emoji: "🔐"
    requires:
      bins: ["akf"]
    install:
      - id: pip
        kind: pip
        package: akf
        bins: ["akf"]
        label: "Install AKF CLI (pip)"
      - id: npm
        kind: npm
        package: akf-format
        bins: []
        label: "Install AKF TypeScript SDK (npm)"

markdown

- npm: `npm install akf-format`
- PyPI: `pip install akf`

Technical Analysis

The Skill identifies the PyPI package akf and npm package akf-format without exact version constraints, integrity hashes, signatures, or a project lockfile. These mutable package references may resolve to releases that differ from those originally reviewed. The repository contains only SKILL.md, so it provides no local implementation against which the installed packages' behavior can be audited.

This does not establish that either named package is malicious. It creates a supply-chain weakness whereby future package compromise, maintainer-account compromise, or an unexpectedly unsafe release could introduce code that was not covered by this audit.

Attack Path

1. An attacker compromises a referenced registry package or its publisher account and publishes a malicious release.
2. A user or Skill installer resolves akf or akf-format without a version pin.
3. The package manager retrieves the mutable release.
4. Malicious package lifecycle logic may execute during installation, or attacker-controlled functionality may execute when the installed CLI or SDK is used.
5. The payload operates with the privileges and accessible environment of the installing user or agent process.

Impact Assessment

Successful exploitation could permit arbitrary ...[truncated 409 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an exact, reviewed version.
• Use lockfiles with cryptographic integrity data where supported.
• Verify distribution hashes or trusted signatures before installation.
• Document the expected registry, publisher identity, source repository, and reviewed release.
• Prefer reproducible installation using a controlled package index or vetted internal mirror.
• Run installation and package commands in a least-privileged, isolated environment without unnecessary secrets.
• Establish a dependency-update review process so later releases are audited before pins are changed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:113

Finding

Execution of Replay Commands Stored in Input Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 113–124
Vulnerability Type: Unsafe execution of file-supplied commands
Risk Level: High

Vulnerable Code

markdown

### Falsifiable evidence (v1.6)

Stamp with a replay recipe so the next agent can re-check the claim instead of trusting the label:

```bash
akf stamp app.py --evidence "42/42 tests passed" --replay "pytest -q"
akf replay app.py          # inspect: recipe + input drift since issuance
akf replay app.py --run    # execute: CONFIRMED / CONFIRMED_DRIFTED / REFUTED

CONFIRMED_DRIFTED means the probe succeeded but the claim's inputs (dependencies, cited sources) changed since stamping — provably reproducible, possibly reproducibly wrong. Never --run a recipe from a file you haven't read: it executes the recorded command.

text

### Technical Analysis

The documented workflow allows `akf replay <file> --run` to execute a command recorded in a file's metadata. Consequently, the inspected file is not merely passive data; it can influence a command-execution boundary.

The warning to read a file first provides useful caution but is not a complete security control. Reading content does not enforce command provenance, constrain allowed executables or arguments, reject shell metacharacters, prevent path substitution, or isolate execution. If an agent treats a replay recipe as trusted evidence and runs it automatically, a crafted or compromised file could cause arbitrary commands to execute.

The exact parsing and process-launch semantics reside in the external `akf` implementation and were not present in the audited project. The risk confirmed here is that the Skill explicitly recommends an execution mode for commands supplied through files; no claim is made that the external CLI contains a specific parser-level command-injection defect.

### Attack Path

1. An attacker creates or modifies a file containing an AKF replay recipe with a ma
...[truncated 1128 chars]

Remediation

View remediation

Remediation Suggestions

• Do not execute replay recipes automatically or solely because metadata reports a favorable trust score.
• Require explicit, informed user approval that displays the exact command, arguments, working directory, and relevant environment before execution.
• Authenticate the artifact and recipe provenance using a trusted signature rather than relying only on embedded metadata.
• Parse recipes into a structured executable-and-arguments format; avoid invoking a shell.
• Enforce an allowlist of approved executables, arguments, paths, and environment variables.
• Reject shell operators, command substitution, redirection, unexpected absolute paths, and traversal sequences.
• Execute approved recipes inside a disposable sandbox with least privilege, restricted filesystem access, no sensitive environment variables, and network access disabled by default.
• Provide an inspection-only mode as the default and clearly distinguish it from execution.
• Record an audit log of the recipe, artifact digest, authorization decision, and execution result.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

fall below the threshold and akf check reports LOW:

bash

akf stamp memory/facts.md --preset memory --agent openclaw
akf check memory/facts.md   # LOW after ~a month → re-verify before relying on it

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

akf:
  v: "1.0"
  claims:
    - c: "Trust metadata for skills/openclaw-akf/SKILL.md"
      t: 0.7
      id: 61200a7e
      src: unspecified

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Skill Supply-Chain Trust

Never load a downloaded skill without checking it first:

bash

akf check downloaded-skill.md

Static analysis

No suspicious patterns detected.