Inventory Waste Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.1

Overview

The skill appears aligned with inventory optimization, but its setup asks users to execute an unpinned third-party npm package and the business-data/ordering permissions are not tightly scoped.

Before installing, verify the ThumbGate package name, publisher, repository, and version, then run a pinned reviewed version in a least-privilege environment. Connect only the specific Google Sheets needed, prefer read-only access unless order/PO creation is intentionally required, and require human approval for any purchase or manual override workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup-guide.md:3

Finding

Unpinned Third-Party Package Is Downloaded and Executed During Setup

Content

View full analysis

Vulnerability Details

File Location: setup-guide.md, line 3
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. Install ThumbGate: `npx thumbgate init --agent openclaw`

Technical Analysis

The setup guide instructs users to execute thumbgate through npx without specifying an exact package version. If the package is not already installed locally, npx may retrieve the package from the configured npm registry and immediately execute its entry point with the permissions of the invoking user.

The project provides no version pin, lockfile, integrity hash, verified publisher information, or vendored and reviewed copy of the dependency. Consequently, the code executed during installation can differ from the code originally assessed. A compromised package release, malicious ownership transfer, registry account takeover, or dependency substitution could turn this setup command into an arbitrary-code execution vector.

Attack Path

1. An attacker compromises the npm account, publishing workflow, or distribution channel associated with the thumbgate package, or otherwise causes a malicious release to resolve under that package name.
2. The attacker publishes a modified latest release containing a malicious installation or command entry point.
3. A user follows setup-guide.md and runs npx thumbgate init --agent openclaw.
4. npx resolves and downloads the unpinned release from the configured registry.
5. The malicious package code executes under the user's account during initialization.
6. The payload can perform any operation allowed by that user's local permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the setup command. Depending on that user's permissions and local environment, the malicious dependency could read or modify acces ...[truncated 486 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin thumbgate to an exact, reviewed version rather than relying on the latest registry release, for example:

   bash

   npx --yes thumbgate@X.Y.Z init --agent openclaw
   

2. Verify the package's official name, publisher identity, source repository, release provenance, and signatures before recommending execution.
3. Commit an appropriate lockfile and integrity metadata where the installation workflow permits it.
4. Prefer installing the reviewed dependency locally and invoking it with npx --no-install, preventing an implicit network download at execution time.
5. Use npm provenance verification, registry allowlisting, and automated dependency scanning in the release process.
6. Execute initialization with least privilege in an isolated environment and avoid exposing unrelated credentials or sensitive environment variables.
7. Document the expected files, network access, and configuration changes made by initialization so users can validate its behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx thumbgate init --agent openclaw without a pinned package version allows the latest published thumbgate package to be fetched and executed at install time. If the package is compromised, typosquatted, or a malicious update is published, this setup step can lead to arbitrary code execution on the operator's machine and compromise the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.