Security audit

Pincushion Openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for feedback-to-code workflows, but it asks users to run mutable third-party code, embed a mutable browser script, and enable cloud sync without enough scoping or safeguards.

Review this skill carefully before installing. Prefer a pinned `pincushion-mcp` version, use local-only mode unless cloud sync is required, avoid placing the widget on sensitive production pages, and store the license key outside the repository or with restrictive permissions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: config-snippet.json:5
Finding: Unpinned npm Package Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:76
Finding: Mutable Third-Party JavaScript Is Executed in Deployed Application Pages
Content: View full analysis
``` ### Technical Analysis The instructions recommend inserting a remotely hosted JavaScript file into the application's root layout or HTML. The URL is not versioned and the example does not provide a Subresource Integrity digest. Consequently, the code executed in visitors' browsers may change after the Skill and application have been reviewed. Remote scripts execute in the embedding page's origin context, subject to browser security controls and the application's Content Security Policy. Such a script can ordinarily inspect and modify accessible DOM content, observe data rendered on the page, register event handlers, and issue network requests. The documented purpose already requires collecting page context such as selectors, DOM snippets, viewport information, and feedback, making strict control over the delivered script particularly important. ### Attack Path 1. An attacker compromises the widget's hosting infrastructure, deployment pipeline, DNS path, or an account authorized to update `pin.js`. 2. The attacker replaces the mutable widget response with modified JavaScript. 3. A visitor opens a deployed or staging page containing the recommended script tag. 4. The browser downloads and executes the modified script in the page context. 5. The payload accesses page data and browser-accessible functionality, then manipulates the application or sends collected information to an attacker-controlled endpoint, subject to browser and CSP restrictions. ### Impact Assessment Exploitation affects users who load pages containing the widget. Depending on the application's design and browser controls, impact could include exposure of DOM-visible information, unauthorized page modifica ...[truncated 321 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: License Credential Is Stored as Plaintext Inside the Project Directory
Content: View full analysis
/path/to/your/project/.feedback/.license-key ``` The surrounding guidance states: ```text Pick whichever fits your host — do not rely on passing the key through the MCP `env` block: OpenClaw's env-safety filter only allowlists `*_API_KEY`-style names, and `PINCUSHION_LICENSE_KEY` can be stripped. ``` ### Technical Analysis The recommended command writes a reusable license credential to a plaintext file beneath the project directory. It does not set restrictive file permissions, verify that `.feedback/.license-key` is excluded from version control, or recommend an operating-system secret store. A project-local credential can be exposed to repository-indexing tools, backup systems, archive creation, collaborators, and processes that have broad project-directory access. It may also be committed accidentally if the path is not ignored. The use of ordinary shell redirection additionally leaves the resulting permissions dependent on the user's current `umask`. The documentation presents this storage method as an alternative when an environment-safety filter removes the variable. While this is disclosed behavior rather than hidden bypass code, it weakens credential handling by moving the secret into the repository tree. ### Attack Path 1. A user follows the headless-host setup instructions and writes the license key to `.feedback/.license-key`. 2. The file receives permissions determined by the current account and `umask`, and remains inside the project tree. 3. Another local process, repository-aware Agent tool, collaborator, backup job, packaging command, or version-control operation accesses the file. 4. The plaintext value is copied, logged, archived, or committed. 5. A party obtaining the credential uses it against the Pincushion service to the ext ...[truncated 500 chars]
Remediation: View remediation
/secure/path/pincushion-license-key ``` - Explicitly add `.feedback/.license-key` to `.gitignore` and relevant backup, archive, logging, and Agent-indexing exclusions. - Validate permissions during startup and refuse to use a credential file that is readable by unintended users. - Avoid placing the literal secret directly in interactive shell commands where shell history or process instrumentation could expose it. - Document credential revocation and rotation procedures, and rotate any key suspected of having entered source control or an archive. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run an MCP server via npx pincushion-mcp without pinning an exact package version or integrity-checked source. Because this server is granted access to local project context and participates in an automated fix loop, a compromised or malicious upstream package update could execute arbitrary code or alter agent behavior with little friction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The login/authentication step again references npx pincushion-mcp without a pinned version, creating the same supply-chain exposure during an authentication-sensitive workflow. If the package were replaced or tampered with, users could be prompted into leaking credentials, installing backdoors, or trusting a malicious MCP server that has repo-level access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill tells users to embed a remote third-party script directly into their application's root HTML without meaningful security, privacy, or trust-boundary warnings. A remotely hosted script executes with full privileges in the application's origin, so compromise of the vendor, the script distribution path, or misuse of collected page data could expose sensitive DOM content, user sessions, internal routes, or stakeholder information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration enables --cloud-sync even though the described skill only needs to read local pin metadata and apply fixes in a project directory. Cloud synchronization can exfiltrate screenshots, DOM snippets, stakeholder threads, and acceptance criteria to a remote service, expanding the trust boundary and creating unnecessary data exposure risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The cloud synchronization capability is broader than the stated purpose of processing pinned stakeholder feedback on live web pages. Because the skill handles potentially sensitive page content and project context, an unjustified sync feature increases the chance of unintended third-party disclosure without a clear operational need.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.