T03 · Remote Payload Retrieval and Execution
Error
- Location
openclaw-plugin/actions/skills.mjs:75- Finding
Unverified Remote Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
js-eyes
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed browser automation and skill-runtime tool, but its skill install and discovery paths include review-worthy unsafe remote install and overly broad network-fetch behavior.
Install only if you deliberately need local browser automation and JS Eyes skill runtime support. Keep the server on localhost with token authentication, leave raw eval disabled unless a task truly requires it, use the staged `skills/plan-install` plus CLI approval path instead of the `curl | bash` command, avoid untrusted custom registries, and consider disabling Native Messaging auto-install and skill directory watchers in hardened environments.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
openclaw-plugin/actions/skills.mjs:27- Finding
Caller-Controlled Registry URL Enables Server-Side Request Forgery and Unbounded Response Processing
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
packages/protocol/skills.js:560- Finding
Registry-Controlled Bundle URLs Permit Internal Network Requests and Unbounded Downloads
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (92)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file explicitly instructs users to link, trust, and invoke external skills, and it notes that worker mode is not an OS sandbox and cannot fully contain filesystem, process, or network access. Dynamic loading and execution of externally linked skill modules therefore creates a real high-risk code-execution boundary: a trusted or mistakenly trusted skill can execute arbitrary local code with host-reachable capabilities.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script.execute action accepts arbitrary JavaScript and runs it in a chosen browser tab, enabling unrestricted DOM access, content extraction, request triggering, form interaction, and page modification in the user's authenticated browser context. That can be used to steal sensitive data from web apps, manipulate transactions, or bypass intended workflow constraints through the browser's existing trust/session state.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- packages/protocol/safe-npm.js:91
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- packages/protocol/skill-runner.js:39
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- packages/protocol/tests/safe-npm.test.js:43