ClawHub
Back to skill

Security audit

OrgX

Security checks for vulnerabilities and agentic risk

Overview

This OrgX skill is coherent for work orchestration, but it needs review because it can send broad agent memory and work logs to an external service with limited safeguards.

Review the data-sharing implications before installing. Use this only where sending status, task details, memory summaries, and logs to OrgX is acceptable; avoid syncing raw MEMORY.md or daily logs that may contain secrets or sensitive internal information. Prefer a pinned reviewed plugin version and keep ORGX_API_KEY out of chats, logs, and repositories.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash
# Install the plugin
openclaw plugins install @useorgx/openclaw-plugin

# Or via npx
npx @useorgx/openclaw-plugin

Technical Analysis

The documented installation commands resolve @useorgx/openclaw-plugin without an exact version or integrity hash. In particular, npx may download and immediately execute the version currently selected by the package registry.

This creates a supply-chain risk because the code ultimately executed can change after the Skill has been reviewed. If the package publisher account, registry, package release, or transitive dependency is compromised, following these instructions could execute malicious code locally.

No evidence in the audited file establishes that the referenced package is currently malicious. The vulnerability is the unsafe, unpinned installation and execution mechanism.

Attack Path

  1. An attacker compromises the package publisher, registry distribution path, package release process, or a transitive dependency.
  2. The attacker publishes a malicious version that can be selected by the unpinned package reference.
  3. A user follows the Quick Start instructions and invokes the plugin installation or npx command.
  4. The package manager retrieves the attacker-controlled release.
  5. Malicious lifecycle scripts or package entry-point code execute with the privileges of the user running the command.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's account. Depending on that account's permissions, the payload could access project files, environment variables, local credentials, agent configuration, or other user-accessible resources.

The finding does not itself demonstrate privilege escalation beyond the invoking user. The ultimate scope depends on the privileges and secrets available in the execution enviro ...[truncated 6 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to a specific, reviewed version rather than resolving the latest available release.
  • Maintain a lockfile that fixes all transitive dependency versions.
  • Verify package integrity using trusted checksums, signatures, or package-manager integrity metadata.
  • Document and enforce the expected registry and official package source.
  • Review package contents and lifecycle scripts before installation.
  • Disable dependency lifecycle scripts where operationally feasible.
  • Avoid using npx to download and immediately execute an unverified package.
  • Run installation and plugin execution in a sandbox or least-privileged environment with restricted access to credentials and sensitive files.
  • Establish a controlled upgrade process in which new versions are reviewed before deployment.

other

Warning
Location
SKILL.md:69
Finding

Unrestricted External Synchronization of Agent Memory and Daily Logs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–75
Vulnerability Type: other: Sensitive Data Exposure
Risk Level: Medium

text
### Org Status & Sync

**`orgx_status`** — View active initiatives, agent states, pending decisions, tasks.

**`orgx_sync`** — Push local memory/daily log to OrgX, receive org context back.
javascript
orgx_sync({
  memory: "Contents of MEMORY.md",
  dailyLog: "Today's session summary"
})

Technical Analysis

The Skill instructs the agent to submit the contents of local memory and daily logs to OrgX without specifying data minimization, secret redaction, sensitivity classification, destination validation, retention controls, or explicit approval for each transfer.

Agent memory and session logs may contain repository details, internal URLs, user information, conversation context, operational data, or secrets accidentally retained from previous work. Sending complete contents to an external service increases the chance that information unrelated to the reporting task will cross a trust boundary.

No evidence in the audited file proves that data is currently being misused or that the service is malicious. The issue is the broad synchronization instruction and absence of safeguards governing potentially sensitive content.

Attack Path

  1. An agent memory file or daily log acquires sensitive information during ordinary work.
  2. The Skill directs the agent to pass the complete memory and log content to orgx_sync.
  3. The agent invokes the synchronization tool without redacting or limiting the content.
  4. OrgX receives and processes or stores information that may exceed what is necessary for work reporting.
  5. The exposed information becomes subject to the external service's access controls, retention practices, operators, and potential compromise surface.

Impact Assessment

The primary impact is unauthorized or excessive disclosure of information available in agent memory and daily log ...[truncated 428 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace whole-file synchronization with an explicit allowlist of fields required for organizational reporting.
  • Default to metadata-only summaries rather than raw memory or complete daily logs.
  • Scan and redact API keys, credentials, personal data, internal URLs, and other sensitive values before transmission.
  • Require explicit user confirmation before each synchronization operation, including a preview of the exact content and destination.
  • Clearly identify the receiving endpoint and validate its identity using authenticated, encrypted transport.
  • Document data retention, deletion, access-control, and secondary-use policies.
  • Prevent memory from containing secrets where possible and separate sensitive state from reportable operational context.
  • Apply organizational data-classification rules and block synchronization of restricted content.
  • Record auditable consent and transfer logs without duplicating the sensitive payload.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill recommends executing an unpinned package via npx, which can fetch and run the latest published code at invocation time. That creates a supply-chain risk: a compromised package, malicious update, or typo/namespace takeover could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs syncing MEMORY.md and a daily log to OrgX but does not warn that these may contain secrets, internal notes, personal data, or other sensitive content. In an orchestration/memory-management skill, this context makes the issue more dangerous because users are likely to transmit rich operational context by default to an external system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages connecting directly to mcp.useorgx.com for a broad tool suite without clearly warning that prompts, work artifacts, and task metadata may be sent to an external service. Because this skill is designed for multi-agent orchestration and reporting, the transmitted data can be extensive and business-sensitive, increasing confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documentation tells users to set ORGX_API_KEY in the environment, which involves handling credentials. There is no accompanying warning about keeping the key secret, avoiding logging/exposing it, or using secure storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.