Subway Agent (90% OFF - Launch Special)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.2

Overview

This WhatsApp ordering skill has a coherent purpose, but it should be reviewed carefully because it stores customer phone/order data in Google Sheets and asks installers to run an unpinned third-party setup command.

Before installing, use a pinned and reviewed ThumbGate version, test in an isolated environment, restrict Google Sheet sharing to a least-privilege service account, add a customer privacy disclosure, and avoid storing phone numbers or free-form notes unless the restaurant actually needs them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup-guide.md:3

Finding

Unpinned Third-Party Package Is Downloaded and Executed During Setup

Content

View full analysis

Vulnerability Details

File Location: setup-guide.md, line 3
Vulnerability Type: Unpinned npm dependency execution
Risk Level: Medium

Vulnerable Code:

markdown

1. Install ThumbGate (if not already): `npx thumbgate init --agent openclaw`

Technical Analysis

The setup guide directs users to execute the thumbgate npm package through npx without specifying an exact version, integrity hash, lockfile, verified publisher, or trusted repository. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute its command-line entry point.

Consequently, the code executed during installation is not fixed to the content reviewed in this project. A newly published, compromised, or malicious package version could run arbitrary commands. npm lifecycle scripts may also execute during package installation unless separately restricted.

The project does not include ThumbGate's implementation, so its behavior cannot be validated as part of this audit.

Attack Path

1. An attacker compromises the npm account or release process associated with the thumbgate package, or otherwise causes a malicious version to be resolved through the user's configured registry.
2. The attacker publishes a version containing a malicious CLI entry point or npm lifecycle script.
3. A user follows the setup guide and runs npx thumbgate init --agent openclaw.
4. npx resolves and downloads the uncontrolled package version.
5. The malicious package code executes with the privileges of the user performing the installation.
6. The code can access resources available to that account and may alter the OpenClaw environment or other user-owned files.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The reachable scope may include:

• Reading or modifying files accessible to the user.

...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ThumbGate to an exact, reviewed version rather than allowing implicit latest-version resolution:

   sh

   npx --yes thumbgate@X.Y.Z init --agent openclaw
   

2. Document the package's official npm scope, publisher, source repository, and expected integrity checksum so users can verify its identity.

3. Review the pinned release's CLI implementation, dependency tree, and lifecycle scripts before recommending execution.

4. Use a lockfile and package-manager integrity metadata where the installation workflow supports them.

5. Disable dependency lifecycle scripts when compatible with the package:

   sh

   npm_config_ignore_scripts=true npx --yes thumbgate@X.Y.Z init --agent openclaw
   

   This option should only be recommended after confirming that ThumbGate does not legitimately require installation scripts.

6. Initially install and test the dependency in an isolated, least-privileged environment with no production credentials.

7. Consider vendoring or distributing an audited release artifact with a cryptographic signature or published checksum.

8. Add dependency monitoring and require review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly logs customer name/phone, order contents, totals, and notes to Google Sheets, but the skill text provides no user-facing privacy notice, consent flow, retention limits, or access controls. In a restaurant WhatsApp context, this creates a realistic risk of over-collection, unauthorized access, and privacy/compliance issues because Google Sheets is often broadly shared and not treated as a secure customer-data store.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition applies to essentially any WhatsApp message that 'sounds like' an order, menu question, or inquiry, which is broad and subjective for a production messaging channel. This can cause the agent to engage on unintended messages, process sensitive customer content without clear scope boundaries, or initiate ordering flows when human review would be more appropriate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The setup guide instructs users to run npx thumbgate init --agent openclaw without pinning an exact package version. That causes execution of whatever version is currently resolved from the registry, which creates supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In a setup document for a production-facing WhatsApp ordering agent, this is more dangerous because operators are likely to copy-paste the command directly on systems with access to credentials and agent configuration.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · setup-guide.md (reported line 6)May include surrounding context.

md

1. Install ThumbGate (if not already): `npx thumbgate init --agent openclaw`
2. Create the Google Sheet above and share it with your OpenClaw service account.
3. **Recommended Voice Provider:** Sign up for [ElevenLabs](https://elevenlabs.io/affiliates) (22% recurring commission for creators) to power the voice ordering features.
4. Copy the SKILL.md above into `~/OpenClaw/skills/subway-restaurant-agent/SKILL.md`
5. Run: `openclaw skill load subway-restaurant-agent`
6. Connect your WhatsApp number in OpenClaw settings.

Static analysis

No suspicious patterns detected.