Clarity First

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.3

Overview

This is a lightweight clarification-protocol skill with no executable payload, credential access, persistence, or hidden data handling.

Safe to install as a conversational workflow aid. Review any optional companion skills before installing them, especially because the documentation uses inconsistent names for the analysis companion and does not pin versions or publishers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:116

Finding

Unpinned and Inconsistently Named Third-Party Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:116-125; README.md:43-52
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code in SKILL.md:

markdown

## Pairs Well With

- **`thinkdeep`** — analyze the solution after the problem is well-defined
- **`task-pilot`** — create an execution plan once requirements are clear

Install the full ThinkStack for best results:
```bash
openclaw install clarity-first
openclaw install thinkdeep
openclaw install task-pilot

text

**Vulnerable code in `README.md`:**
```markdown
## ThinkStack

Clarity First is part of the **ThinkStack** — three skills that make Claude smarter at every stage:

clarity-first → deep-think → task-pilot understand analyze execute

text

```bash
openclaw install clarity-first
openclaw install deep-think
openclaw install task-pilot

text

### Technical Analysis

The documentation recommends installing third-party skills using mutable package names without specifying exact versions, verified publisher identities, integrity hashes, or immutable source references. Consequently, the content installed by these commands may differ from the content that was available when this project was audited.

The recommended analysis skill also has inconsistent names: `SKILL.md` uses `thinkdeep`, whereas `README.md` uses `deep-think`. This discrepancy increases the risk of dependency confusion or typosquatting because a user may install the wrong package or an attacker-controlled package registered under one of the similar names.

These external skills are optional integrations and are not required to implement the audited project's documented intent-clarification behavior. No evidence shows that the current project automatically executes the installation commands; exploitation requires a user or agent to follow the recommendation.

### Attack Path

1. An attacker registers 
...[truncated 1302 chars]

Remediation

View remediation

Remediation Suggestions

1. Determine and document one canonical package name for the analysis skill, resolving the thinkdeep versus deep-think inconsistency.
2. Pin every recommended skill to an exact, reviewed version rather than allowing installation of the latest mutable release.
3. Specify and verify the expected publisher or namespace for each dependency.
4. Where supported, provide cryptographic checksums, signatures, lockfiles, or immutable registry references and require verification before installation.
5. Clearly label the additional ThinkStack skills as optional and state that they are outside the security scope of this package.
6. Link to separately audited source repositories and advise users to review permissions and package contents before installation.
7. Avoid having an agent automatically execute these installation commands. Require explicit user approval before retrieving or activating third-party skills.
8. Add a release process that validates package names, versions, publisher identities, and integrity metadata across both README.md and SKILL.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep