Security audit

Ecosystem Quickstart

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent Chinese quickstart guide, but it under-declares the authority needed for global installs, remote skill updates, authentication, script execution, and payment-related writes.

Review this carefully before installing. Use an isolated environment, avoid update-all, verify package and skill publishers, pin versions where possible, and confirm payment/network behavior before letting an agent run the documented commands.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned Remote Packages and Skills Are Installed and Executed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:45-57, 72-95, 119-150, 201-218
Vulnerability Type: Unpinned third-party dependencies and mutable remote updates
Risk Level: Medium

Evidence

bash
npm i -g openclaw

bash
npm i -g clawhub clawhub login

bash
openclaw skills install obsidian-memory-system openclaw skills install soft-ip-full-lifecycle-zijian openclaw skills install database-specialist openclaw skills install cross-platform-memory-hub openclaw skills install soft-ip-full-lifecycle-delivery-pro openclaw skills install ssq-analyzer

bash
openclaw skills install clawtip

bash
python3 scripts/create_order.py "read permanent memory" python3 scripts/service.py "20260716123456123456"

bash
openclaw skills update --all

Technical Analysis

The guide instructs users to install npm packages and OpenClaw Skills without specifying immutable versions, package integrity hashes, trusted publisher fingerprints, or verified artifact references. It subsequently directs the agent to execute Python scripts supplied by those remotely installed Skills.

The mandatory clawtip payment component is especially sensitive because the documented workflow grants it access to local order files, payment state, filesystem writes, and an external payment API. Its implementation is not included in the audited project and therefore cannot be independently reviewed here.

The update --all command further permits reviewed components to be replaced with newer remote versions without per-component review. A compromised registry account, publisher account, dependency, or Skill release could therefore introduce arbitrary code after this guide itself has passed review.

Attack Path

An attacker compromises a referenced npm or ClawHub publisher, dependency, or release channel.

The attacker publishes a malicious version under an existing referenc ...[truncated 1118 chars]
Remediation: View remediation
Remediation Suggestions

Pin every npm package and OpenClaw Skill to an exact, reviewed version.

Provide cryptographic integrity hashes or signed, immutable artifact references.

Document the official registry, package namespace, publisher identity, and signing fingerprint for each dependency.

Avoid global npm installation where possible; use an isolated, least-privileged environment.

Vendor or otherwise expose the source of security-sensitive components such as clawtip for review.

Require explicit user approval before installing or updating executable components.

Replace openclaw skills update --all with explicit, version-specific updates reviewed before installation.

Execute third-party Skills inside a sandbox with narrowly scoped filesystem and network access.

Verify package signatures and integrity before invoking any installed script.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:6
Finding: Declared Permission Scope Understates the Instructed Operations
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:6-11, 48-57, 88-95, 138-150
Vulnerability Type: Misrepresented permission boundary and violation of least privilege
Risk Level: Medium

Evidence

The Skill metadata declares only filesystem read access:

yaml
metadata: author: "Yujin" category: "guide" version: "1.1.0" permissions: - "filesystem.read"

The documented workflow nevertheless requires package installation, authentication, remote Skill installation, script execution, outbound API access, and modification of local order files:

bash
npm i -g openclaw npm i -g clawhub clawhub login

bash
openclaw skills install clawtip

bash
python3 scripts/create_order.py "read permanent memory" python3 scripts/service.py "20260716123456123456"

Technical Analysis

The declared filesystem.read permission does not represent the effective capabilities needed by the documented workflow. The instructions require at least process execution, filesystem writes, outbound network access, package installation, authentication-state access, and payment-related operations.

Although this project is a guide rather than an executable implementation, its instructions define the actions an agent or user is expected to perform. A permission declaration that omits these operations can cause users, hosts, or automated security scanners to approve the Skill under an incorrect least-privilege assumption.

The mismatch is particularly relevant because the guide requires installation of clawtip, a remote component described as reading order files, contacting a payment service, and writing payment credentials back to local storage.

Attack Path

A user or host reviews the metadata and approves the Skill based on its declared filesystem-read capability.

The guide directs the user or agent to install global tools and remote payment middleware.

The work ...[truncated 1096 chars]
Remediation: View remediation
Remediation Suggestions

Declare every capability required by the workflow, including process execution, filesystem writes, outbound network access, package installation, authentication access, and payment operations.

Separate passive documentation functionality from optional installation and payment actions.

Require explicit, informed user confirmation before installing software, authenticating, transmitting order information, or initiating payment.

Restrict filesystem access to the documented order directory rather than granting broad user-level access.

Restrict outbound traffic to explicitly approved HTTPS endpoints and disclose the exact transmitted fields.

Run installed Skills with a sandboxed identity that cannot access unrelated files, credentials, or processes.

Ensure the host validates declared permissions against actual tool calls and blocks undeclared capabilities.

Add clear security documentation describing which operations are performed by the guide, OpenClaw, and clawtip.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: "ecosystem-quickstart" description: > MangoGen 技能生态完整接入指南。指导用户从零配置 OpenClaw 环境、

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that other languages are supported or that the Chinese-only constraint is intentional for a region-specific audience. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.