Spectyra - OpenClaw Workflow & Cost Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.25

Overview

The skill is coherent with its stated goal, but it asks users to install and run an unpinned local companion that becomes the default model provider for agent traffic.

Review this before installing: it globally installs third-party npm code, starts a local HTTP companion/dashboard, and configures OpenClaw to use that companion as the default model path. Prefer a pinned reviewed version, understand what prompts/responses and provider credentials the companion can access, and confirm how to stop or uninstall it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Globally Installed Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-16, SKILL.md:31
Vulnerability Type: Unpinned third-party dependency and mutable package installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: "@spectyra/local-companion"
    bins:
      - spectyra-companion

bash

npm install -g @spectyra/local-companion@latest && spectyra-companion start --open

Technical Analysis

The skill instructs users to install @spectyra/local-companion globally from the npm registry using the mutable latest distribution tag. The declarative installation metadata also identifies the package without pinning an exact version.

Because the companion implementation and an integrity hash are not included in the audited project, the effective executable code cannot be statically verified. A later package release, compromised publisher account, or compromised release process could change what users install without requiring any modification to this reviewed skill.

npm installation may also execute package lifecycle scripts with the privileges of the invoking user. The global installation increases exposure because the resulting executable is placed in the user's global command environment.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component for @spectyra/local-companion.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A user follows the documented global installation command, or an installation workflow resolves the unpinned package.
4. npm downloads the attacker-controlled artifact and may execute its lifecycle scripts with the invoking user's privileges.
5. The installed spectyra-companion executable is started and receives model traffic through http://127.0.0.1:4111/v1.
6. Malicious package code can act with the user's permissions and potentially access data available to the compani ...[truncated 487 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @spectyra/local-companion to an exact, reviewed version in both the installation metadata and documentation.
2. Remove the mutable @latest reference.
3. Publish and verify package integrity information and npm provenance before installation.
4. Avoid global installation where possible; prefer a project-scoped installation under a dedicated, least-privileged account or sandbox.
5. Disable npm lifecycle scripts during installation when operationally feasible, and separately execute only reviewed setup steps.
6. Include the companion source in the review scope or provide a reproducible build and independently auditable source-to-package mapping.
7. Establish dependency monitoring and a controlled upgrade process in which each new version is reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to perform a global npm install and then start a local companion process, but it does not clearly disclose the security-relevant effects of doing so: system-wide package installation, execution of third-party code, opening a local service, and potential persistence/background behavior. Even if intended as normal setup, these commands materially change the host environment and could expose users to supply-chain risk or unintended service exposure if followed without scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly instructs users to install and start a local companion service and advertises a dashboard at http://127.0.0.1:4111/dashboard, but it does not warn that this creates a locally reachable HTTP endpoint. Even though the service binds to loopback, local web services can still increase attack surface through local process access, browser-based interaction, CSRF-style abuse from the same host, or accidental exposure if the companion is later misconfigured.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config-fragment.json:5

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skill.json:5