Openclaw Skill

• Outcome: Pass
• Latest audit: Jun 2, 2026 · 2:29 AM UTC
• Version: 2.0.1

Overview

This is a disclosed blockchain transaction-checking skill, but it should be installed only in a trusted Python environment because it fetches dependencies automatically.

Install only if you trust the Sigui SDK package and the Sigui API endpoint you configure. Use a dedicated virtual environment, review SIGUI_API_URL before production use, avoid demo mode for real funds, and keep the explicit user-confirmation step before any blockchain transaction is sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 sigui-sdk not found. Installing automatically...", file=sys.stderr)
    try:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "sigui-sdk>=0.3.1", "--quiet"],
            timeout=120,
        )

• Confidence: 96% confidence
• Finding: This code automatically runs pip install at import/runtime, which mutates the execution environment and fetches code from external package sources before performing the security evaluation. In a security-analysis skill, this is especially dangerous because a compromised package, dependency confusion event, or untrusted index configuration could lead to arbitrary code execution and undermine the integrity of all subsequent verdicts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timeout=120,
        )
        # Verify import works after install
        result = subprocess.run(
            [sys.executable, "-c", "from sigui import SiguiClient; print('ok')"],
            capture_output=True, text=True, timeout=10,
        )

• Confidence: 84% confidence
• Finding: This subprocess executes a Python one-liner to verify that the newly installed package imports correctly. Although the command itself is static, it still spawns a child interpreter after a dynamic install, increasing attack surface and potentially executing malicious import-time code from an untrusted package.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while instructing the platform to run shell commands and use environment variables, which hides its true execution capabilities from users and policy enforcement. In a security-sensitive skill that can influence transaction decisions and install software, this lack of explicit permission declaration reduces transparency and can enable unexpected command execution or environment access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill presents itself as a real-time blockchain security oracle with advanced detections and on-chain proof, but the described behavior includes runtime package installation, unsupported chain discrepancies, simplistic demo heuristics, and no implementation of the specific threat detections it advertises. In this context, users or agents may rely on a false sense of security to approve high-value blockchain transactions, making the mismatch materially dangerous even if not overtly malicious.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: A security-evaluation skill should be deterministic and minimally privileged, but this one installs software into the runtime environment as part of normal operation. That behavior allows external code to enter the trust boundary at evaluation time, making the oracle itself a potential supply-chain execution vector.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill launches package-management subprocesses that are unrelated to evaluating a transaction and that can download and execute code from external sources. In context, this is more dangerous than a generic subprocess use because the tool is supposed to make security decisions about blockchain transactions; compromising the evaluator compromises every downstream allow/block decision.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documented fail-closed policy says the script should exit when the SDK is unavailable, but the implementation instead tries to install the dependency automatically. This contradiction is dangerous because operators may trust the documented safety model while the actual code expands trust to the network/package ecosystem at runtime.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The install script automatically activates a local virtual environment if present and performs `pip install` from the network without any user confirmation or trust prompt. Because this script is called automatically after skill installation, it modifies the local environment and executes package installation side effects implicitly, which is risky if the package source, dependency chain, or execution context is untrusted.

Static analysis

No suspicious patterns detected.