innovation-research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.24

Overview

This paid research skill is mostly coherent, but it under-discloses local storage of sensitive research prompts and relies on weak local payment authorization.

Review this skill before installing. Avoid entering confidential product strategy, patent ideas, customer data, or trade secrets unless you are comfortable with the full question being saved locally in plaintext. Treat the payment verification as weak because a local order file can be edited, and prefer verified, pinned clawtip tooling for any payment flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service.py:55

Finding

Locally Forgeable Payment Authorization

Content

View full analysis

Vulnerability Details

File Location: scripts/service.py:55-62, 81-90
Vulnerability Type: Payment authorization bypass through unverified local state
Risk Level: High

Vulnerable Code

python

def is_credential_valid(order_data: dict) -> bool:
    credential = order_data.get("payCredential")
    if not credential:
        return False
    credential_ts = order_data.get("credentialTimestamp")
    if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL:
        return False
    return True

python

if not is_credential_valid(order_data):
    print("PAY_STATUS: ERROR")
    print("ERROR_INFO: No valid payment credential found. Complete payment via clawtip first.")
    sys.exit(1)

pay_status = order_data.get("payStatus", "SUCCESS")
print(f"PAY_STATUS: {pay_status}")

if pay_status != "SUCCESS":
    print(f"ERROR_INFO: Payment status is '{pay_status}', cannot proceed")
    sys.exit(1)

Technical Analysis

The authorization decision relies entirely on fields loaded from a locally writable JSON order file. A payment credential is considered valid whenever payCredential contains any truthy value. The code does not verify a digital signature, message authentication code, issuer identity, or cryptographic binding between the credential and the order number, amount, payee, or Skill indicator.

The credential timestamp is optional. If credentialTimestamp is absent, no expiration check occurs. A future timestamp also passes because the computed age is negative. In addition, a missing payStatus is interpreted as "SUCCESS", which creates a fail-open authorization condition.

Attack Path

1. Run scripts/create_order.py to create a valid local order and obtain its order number.
2. Open the corresponding file under ~/.openclaw/skills/orders/{indicator}/{order_no}.json.
3. Add an arbitrary truthy field such as:

   json

   {
     "payCredential": "f
   

...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

• Require a credential cryptographically signed by clawtip and verify it using a pinned, trusted public key.
• Bind the signed claims to the exact order number, amount, payee, Skill identifier, and indicator.
• Require explicit issued-at and expiration timestamps, validate their types, reject timestamps outside an acceptable clock-skew window, and reject credentials issued in the future.
• Require an explicit payStatus value of "SUCCESS"; never default a missing status to success.
• Reject absent, malformed, unsigned, expired, replayed, or incorrectly bound credentials.
• Where supported, verify the transaction identifier against an authoritative payment record and prevent reuse.
• Treat the local JSON document only as storage, not as a trusted source of authorization state.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Installation and Execution of Insufficiently Integrity-Pinned Third-Party Components

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-50, 70-72
Vulnerability Type: Third-party dependency and package execution risk
Risk Level: Medium

Vulnerable Instructions

bash

openclaw skills install clawtip

bash

npx --yes @clawtip/clawtip-sandbox-cli@1.0.0 pay -o <ORDER_NO> -i <INDICATOR> -v 1.0.12

Technical Analysis

The prerequisite installs the clawtip Skill without specifying an exact immutable version or an integrity digest. The sandbox workflow uses npx --yes, which can automatically download and execute code from the npm registry without an interactive confirmation.

Although the npm command specifies package version 1.0.0, a version identifier alone does not validate the retrieved artifact against a project-controlled checksum. The reviewed project also contains no lockfile, vendored dependency, signature-verification procedure, or trusted artifact digest for these components.

This creates a supply-chain execution boundary: the effective code run during installation or payment is not contained in the audited project and may differ if a package registry, package publisher, distribution channel, or dependency graph is compromised.

Attack Path

1. A user follows the documented prerequisite or sandbox payment instructions.
2. The package manager resolves and retrieves an external clawtip Skill or npm package.
3. A compromised publisher account, package registry, package artifact, or transitive dependency supplies hostile code.
4. The installation process, lifecycle scripts, or CLI entry point executes that code under the privileges of the user running the Skill.

This finding identifies unsafe dependency acquisition and execution practices. The reviewed files do not establish that the current upstream packages are malicious.

Impact Assessment

A compromised dependency could execute with the permissions of the invoking user. Depending on the ...[truncated 281 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the clawtip Skill to an exact reviewed version and immutable artifact digest.
• Verify package signatures or cryptographic checksums against values distributed through a separate trusted channel.
• Commit a lockfile containing resolved dependency versions and integrity hashes where applicable.
• Prefer a reviewed, vendored artifact or an organization-controlled immutable package mirror.
• Avoid automatic package download and execution through npx --yes in sensitive workflows.
• Disable package lifecycle scripts where feasible and execute third-party components in a restricted sandbox with minimal filesystem, network, and credential access.
• Document the expected publisher identity, repository, release digest, and verification procedure.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/create_order.py:55

Finding

User Research Question Stored in Plaintext with Default File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/create_order.py:55-62, 163-174
Vulnerability Type: Plaintext storage of potentially sensitive user input
Risk Level: Low

Vulnerable Code

python

def _save_order(indicator, order_no, order_data):
    _validate_order_no(order_no)
    order_dir = _get_orders_dir(indicator)
    os.makedirs(order_dir, exist_ok=True)
    path = os.path.join(order_dir, f"{order_no}.json")
    with open(path, "w", encoding="utf-8") as f:
        json.dump(order_data, f, ensure_ascii=False, indent=2)
    return path

python

order_data = {
    "payTo": pay_to,
    "amount": AMOUNT,
    "order_no": order_no,
    "encrypted_data": encrypted_data,
    "slug": SLUG,
    "question": question,
    "description": DESCRIPTION,
    "resource_url": RESOURCE_URL,
}

_save_order(indicator, order_no, order_data)

Technical Analysis

The complete user-supplied research question is written to a persistent JSON file in plaintext. Only the payment payload placed in encrypted_data may be encrypted; the question field remains directly readable.

The file is created using ordinary open(..., "w") semantics and therefore relies on the process umask for access restrictions. The script does not explicitly apply owner-only permissions. This is particularly relevant because research questions may contain company information, patent details, unreleased product plans, or other confidential context.

The behavior also conflicts with the documentation's broad claim that company information and business secrets are never collected. Such content can be included in the question and is then stored locally.

Attack Path

1. A user supplies confidential information as part of the research question.
2. create_order.py writes the complete question to the local order JSON file.
3. Another local account or process with permission to read the file accesses the plai ...[truncated 683 chars]

Remediation

View remediation

Remediation Suggestions

• Do not persist the research question unless it is strictly required for the payment workflow.
• Store only a non-sensitive order reference or a cryptographic digest when the original text is unnecessary.
• If persistence is required, encrypt the question using an authenticated encryption mode and keep the key outside the order file.
• Create directories with owner-only permissions and create order files atomically with mode 0600.
• Validate existing directory ownership and permissions before writing.
• Define and enforce a short retention period, securely deleting order content after completion.
• Update the documentation to disclose accurately that the full question is stored locally and may contain confidential information.
• Warn users not to include secrets or regulated data unless protected storage is enabled.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description strongly emphasizes AI-delivered research and privacy assurances, but the documented behavior includes creating local order files containing the user's question and handling payment-related material. That mismatch can mislead users about what data is stored and what the scripts actually do, undermining informed consent and increasing privacy risk if sensitive business questions are entered. In this context, the danger is elevated because research prompts may contain proprietary strategy, patent ideas, or confidential product plans.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction '请使用中文与用户交互。' forces a specific language for all interactions. The policy allows language constraints only when the user is offered a choice or the locale restriction is clearly justified; neither is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that order files contain orderNo, amount, question, and encrypted payment credentials, but it does not present this as a prominent warning at the point users provide input. Users may submit confidential research topics believing the skill does not collect or persist sensitive information, when in fact their question is written to disk. For an innovation-research skill, prompts are especially likely to contain trade secrets, product strategy, or patent-sensitive material, which makes local persistence more dangerous than in a generic consumer task.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file-level documentation states that only a narrow set of fields are stored, but the implementation also persists additional metadata such as description and resource_url. This mismatch is a security-relevant integrity issue because users and downstream tooling may make trust decisions based on false minimization claims, reducing informed consent around what is retained locally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The script persists the user-provided question and payment-related order metadata under the user's home directory, creating session-like local retention beyond immediate execution. In this skill context, the 'question' may contain sensitive business, R&D, patent, or competitive research information, so local persistence increases confidentiality risk if the workstation or account is shared or later compromised.

Content

Scanner excerpt · scripts/create_order.py (reported line 183)May include surrounding context.

python

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create innovation-research order for clawtip payment"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The user-facing notice claims the order file contains only orderNo, amount, and question, but the code writes additional fields including payTo, encrypted_data, slug, description, and resource_url. Misrepresenting stored data is dangerous because it can hide local persistence of payment-related metadata and weaken a user's ability to assess privacy and retention risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits a Chinese-only failure message (订单创建失败) in its CLI output. This imposes a specific language on users without opt-in or fallback, which matches the language/locale policy violation criteria for natural-language content in code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code reads a local order file and accesses the payCredential field to authorize service use, which is access to a sensitive credential. While the module docstring states this behavior, there is no user-facing disclosure at runtime before or during the credential read, such as a visible notice or confirmation prompt.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.