SEO to HTML Maker (via Kanban Plugin)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:37 AM UTC
• Version: 1.0.1

Overview

This is a disclosed SEO-to-HTML workflow, but it depends on a separate cloud-enabled plugin users should review before installing.

Before installing, review the claw-kanban plugin source and permissions, prefer a pinned or verified version when available, and only use the dashboard/API-key flow if you are comfortable sending workflow content to that service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16
Vulnerability Type: Unpinned and unaudited third-party dependency installation
Risk Level: Medium

Code Snippet:

markdown

# 🚀 STOP: THIS REQUIRES A PLUGIN! 🚀

This skill is the "brain", but it needs the "hands". Before using this workflow, you **MUST** install the companion plugin in your terminal to enable Markdown-to-HTML conversion and cloud tracking:

```bash
openclaw plugins install claw-kanban

Get your free Dashboard API Key to see the visualization at: https://teammate.work

text

### Technical Analysis

The skill mandates installation of the third-party `claw-kanban` plugin by package name without specifying a verified version, immutable commit, checksum, or cryptographic signature. The installed implementation is not included in the audited project, so its behavior cannot be validated from the available source.

Because the dependency reference is mutable, the code ultimately installed may differ from the code that was previously reviewed. A compromised package publisher, distribution channel, or future release could introduce malicious behavior. The plugin is also described as supporting cloud tracking and artifact attachment, expanding the trust boundary to an external service and potentially exposing generated topics, research, Kanban metadata, or HTML deliverables.

### Attack Path

1. An attacker compromises the plugin publisher account, package distribution channel, or a mutable future release of `claw-kanban`.
2. The attacker publishes a modified plugin containing malicious initialization or runtime behavior.
3. A user follows the skill's mandatory instruction and runs `openclaw plugins install claw-kanban`.
4. The package manager retrieves and installs the attacker-controlled release because no immutable version or integrity value is required.
5. The malicious plugin executes with the permissions available to t
...[truncated 996 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a reviewed, immutable version or commit rather than installing the latest release by name.
2. Publish an expected cryptographic checksum or require package-signature verification before installation.
3. Vendor the reviewed plugin source when practical so the installed implementation is included in the audit scope.
4. Document all plugin permissions, network destinations, credential requirements, and data fields transmitted to external services.
5. Require explicit user consent before enabling cloud tracking or uploading generated artifacts.
6. Provide a local-only Markdown-to-HTML workflow that does not require a dashboard API key or external data transfer.
7. Run the plugin with least privilege in a restricted environment with limited filesystem, credential, and network access.
8. Establish dependency monitoring and repeat the security review whenever the pinned plugin version changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.