soft-ip-full-lifecycle-delivery-pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 1.3.24

Overview

The skill has a coherent paid document-drafting purpose, but its local payment verification and data-handling disclosures need review before installation.

Review this skill before installing. Use it only if you are comfortable with local order files storing your software description and payment metadata, and verify the clawtip and npx payment tooling provenance before running it. Avoid putting source code, applicant secrets, or confidential business details in the initial question until the publisher tightens payment verification, saved-field disclosure, retention, and authorization boundaries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service.py:48

Finding

Payment Authorization Bypass Through Forged Local Order Data

Content

View full analysis

Vulnerability Details

File Location: scripts/service.py, lines 48-65 and 81-93
Vulnerability Type: Client-controlled payment credential validation
Risk Level: High

Vulnerable Code

python

def _load_order(indicator, order_no):
    _validate_order_no(order_no)
    path = os.path.join(_get_orders_dir(indicator), f"{order_no}.json")
    if not os.path.isfile(path):
        raise RuntimeError(f"Order file not found: {path}")
    with open(path, "r", encoding="utf-8") as f:
        return json.load(f)

def is_credential_valid(order_data: dict) -> bool:
    credential = order_data.get("payCredential")
    if not credential:
        return False
    credential_ts = order_data.get("credentialTimestamp")
    if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL:
        return False
    return True

python

if not is_credential_valid(order_data):
    print("PAY_STATUS: ERROR")
    print("ERROR_INFO: No valid payment credential found. Complete payment via clawtip first.")
    sys.exit(1)

pay_status = order_data.get("payStatus", "SUCCESS")
print(f"PAY_STATUS: {pay_status}")

if pay_status != "SUCCESS":
    print(f"ERROR_INFO: Payment status is '{pay_status}', cannot proceed")
    sys.exit(1)

Technical Analysis

The payment authorization decision is based entirely on fields loaded from an unauthenticated JSON file in the current user's home directory. The validation routine only checks whether payCredential is non-empty. It does not cryptographically validate the credential or bind it to the order number, payment amount, recipient, skill indicator, or merchant.

Timestamp enforcement is also fail-open. If credentialTimestamp is absent, the credential is accepted indefinitely. In addition, payStatus defaults to SUCCESS when the field is absent. Consequently, an attacker who can modify their own order file can fabricate all data required to pass au ...[truncated 1110 chars]

Remediation

View remediation

Remediation Suggestions

1. Cryptographically verify every payment credential using a trusted clawtip public key, authenticated API, or equivalent authoritative verification mechanism.
2. Bind the verified credential to the expected order_no, amount, recipient address, merchant, skill indicator, and transaction identifier.
3. Require credentialTimestamp to be present, numeric, within the allowed lifetime, and not unreasonably far in the future.
4. Require an explicit authenticated payStatus value of SUCCESS; never default a missing status to success.
5. Reject malformed, missing, unknown, or duplicate credential fields using a strict schema.
6. Protect persisted order data with an authenticated signature or message authentication code. File permissions alone must not be treated as proof of payment.
7. Track consumed transaction identifiers to prevent credential replay across orders.
8. Fail closed whenever verification infrastructure is unavailable or any verification step fails.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Unverified Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-64 and 81-85
Vulnerability Type: Unverified dependency installation and execution
Risk Level: Medium

Vulnerable Code

bash

openclaw skills install clawtip

bash

npx --yes @clawtip/clawtip-sandbox-cli@1.0.0 pay -o <ORDER_NO> -i <INDICATOR> -v 1.0.12

Technical Analysis

The documented workflow directs users to install an unversioned clawtip skill and to use npx --yes to download and execute a package from a registry automatically. The project provides no checksum, package signature, lockfile, vendored artifact, or independently verified source reference.

Pinning the top-level sandbox CLI to version 1.0.0 reduces accidental version drift but does not establish package integrity or necessarily pin all transitive dependencies. The unversioned skill installation is even less deterministic. If the registry package, publisher account, distribution channel, or a transitive dependency is compromised, malicious installation or lifecycle code could execute under the invoking user's account.

Attack Path

1. An attacker compromises the relevant package publisher, registry entry, package distribution channel, or an eligible transitive dependency.
2. Malicious code is introduced into the dependency resolved by the documented installation or npx command.
3. A user follows the documented workflow.
4. openclaw skills install or npx --yes retrieves the affected component without project-supplied integrity verification.
5. The malicious package executes with the permissions of the user running the command.

Impact Assessment

Successful supply-chain compromise could permit arbitrary code execution with the invoking user's privileges. Depending on those privileges and the malicious package behavior, the affected scope could include accessible files, environment variables, local credentials, order records, and netw ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the clawtip skill to a reviewed, immutable version rather than installing an unspecified release.
2. Publish and verify cryptographic checksums or signatures for every executable package.
3. Use a lockfile or another reproducible dependency manifest that pins transitive dependencies.
4. Prefer a reviewed, pre-fetched, or vendored artifact over automatic execution through npx --yes.
5. Document the authoritative registry, publisher identity, source repository, and signature-verification procedure.
6. Disable or audit package lifecycle scripts where feasible.
7. Run payment tooling with the minimum required permissions and in an isolated environment.
8. Establish an update-review process so dependency changes are assessed before deployment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script’s docstring claims the order file stores only limited metadata, but the implementation also persists the plaintext user question, description, and resource URL. More importantly, if SM4 encryption is unavailable or fails, encrypted_data silently falls back to the plaintext payment payload, creating an integrity and confidentiality gap between what operators/users are told and what is actually written to disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The script persists user-supplied question content to a predictable per-user path under the home directory, creating local session/order artifacts that may contain sensitive software descriptions or business details. In the context of a software copyright filing skill, the question is more likely than usual to include proprietary product information, so unnecessary persistence increases confidentiality risk on shared or compromised endpoints.

Content

Scanner excerpt · scripts/create_order.py (reported line 181)May include surrounding context.

python

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create order for software copyright filing document service"
    )
    parser.add_argument("question", help="Software description / user request")
    args = parser.parse_args()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill performs local filesystem reads under the user's home directory to retrieve order records, which expands its effective data access beyond simple conversational document drafting. If an attacker or another local process can plant or modify those files, the service may trust forged payment state or expose local path and file handling behavior, making the skill more dangerous than its stated purpose suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script loads order data, including payment-related fields, from a local JSON file even though the skill description claims that applicant information and filing documents are not uploaded or handled this way. This creates a trust and privacy gap: locally stored order files may contain sensitive data, and the mismatch between declared behavior and actual data access can mislead users and reviewers about what information is processed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits the authorized document list using Chinese titles only, and there is no indication that the user can choose another language or that the skill is restricted to a Chinese registration workflow. This is a natural-language locale policy concern because the skill imposes a specific language in user-facing content without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill describes a broad conversational document-generation service after payment, but it does not define clear invocation boundaries, input restrictions, or refusal conditions for sensitive content. In this context, that can enable overbroad use, including generating fabricated application materials or code-document artifacts from minimal user description without sufficient validation of legitimacy or ownership.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI notice tells users the saved file contains only orderNo, amount, and question, but the file also includes payTo, encrypted_data, slug, description, and resource_url. This is primarily a transparency and data-handling issue: users may disclose information under false assumptions about what is stored locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains a user-facing string literal in Chinese for the failure path, which forces a specific language without user opt-in. The policy for natural-language violations applies to all file types, including code string literals.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.