Ipv6 P2p

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:58 AM UTC
• Version: 0.1.3

Overview

The skill matches its P2P messaging purpose, but it joins and advertises on a peer-discovery network and installs unpinned external code, so users should review it before installing.

Install only if you are comfortable with the agent participating in a Yggdrasil P2P network, announcing itself to bootstrap and discovered peers, and receiving inbound P2P messages. Prefer a pinned, audited package version and explicit controls to disable or restrict discovery before using it in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned External Node.js Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–12
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: "@resciencelab/declaw"

Technical Analysis

The skill instructs the platform to install the external Node.js package @resciencelab/declaw without specifying an exact version or integrity hash. Consequently, the installed code may change after this skill has been reviewed.

The package's executable source is not included in the audited project. Its installation scripts, runtime behavior, network operations, message processing, cryptographic key handling, and claimed security controls therefore cannot be verified from this repository. Package-manager resolution may select a future or compromised release rather than the release intended by the skill author.

This creates a supply-chain risk if the package publisher account, registry distribution path, or a later package release is compromised. The finding does not establish that the current package is malicious; it identifies the absence of controls that bind installation to a reviewed artifact.

Attack Path

1. An attacker compromises the package publisher account, registry account, or another part of the package distribution chain.
2. The attacker publishes a malicious release under the legitimate @resciencelab/declaw package name.
3. A user installs the skill after that release becomes resolvable.
4. Because no exact version or integrity value is specified, the installer resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts or runtime code execute with the permissions of the package installer or OpenClaw agent process.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the security context of the installer or agent process. Depending on that process's permissions, an attacker could access agent-readabl ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific, reviewed version rather than allowing unconstrained package resolution.
2. Record and verify the package artifact's cryptographic integrity through a lockfile or platform-supported integrity hash.
3. Commit the applicable lockfile and enforce immutable or frozen-lockfile installation in deployment.
4. Audit the pinned package's source, transitive dependencies, installation lifecycle scripts, network behavior, and cryptographic key handling.
5. Disable package lifecycle scripts where they are unnecessary, or explicitly review every required lifecycle script before installation.
6. Run installation and runtime operations in a least-privileged sandbox with restricted filesystem, credential, and network access.
7. Consider vendoring the reviewed executable source or otherwise making it available with the skill so its effective behavior can be audited together with the skill definition.
8. Use automated dependency monitoring and require security review before updating the pinned version or integrity metadata.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that peer discovery 'announces to all bootstrap nodes and fans out to newly-discovered peers' but does not clearly warn the user that invoking discovery may broadcast their presence and network metadata beyond an intended single peer. In a P2P messaging context, this can expose the user's node to additional parties, create privacy surprises, and trigger unintended network activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation describes automatic outbound peer announcements to remote bootstrap nodes and newly discovered peers, as well as serving discovery endpoints, but does not provide a user-facing warning or consent model for this network behavior. This can expose the agent's presence, network address, and participation in a peer graph without the operator fully realizing it, increasing privacy and attack-surface risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.