Smartlead

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:03 AM UTC
• Version: 0.3.2

Overview

The skill is broadly related to Smartlead automation, but its setup enables a persistent OpenClaw plugin from an unaudited hardcoded local path and wires lead-reply data into an agent/Slack workflow.

Review this skill before installing. It is not evidence of malware, but only use setup.sh if you have separately reviewed the OpenClaw plugin at /home/worker/code/openclaw-smartlead, understand that Smartlead reply data may be sent through OpenClaw to Slack, and are comfortable enabling persistent webhook-driven agent behavior. Prefer pinned, reviewed CLI/plugin versions and avoid linked development-mode installs in production.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:13
• Finding: Unverified External Plugin Is Linked and Enabled## Vulnerability Details **File Location**: `setup.sh`, lines 13 and 19–22 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable code:** ```bash PLUGIN_DIR="/home/worker/code/openclaw-smartlead" ``` ```bash if command -v openclaw >/dev/null 2>&1; then echo "Installing plugin in linked mode..." openclaw plugins install -l "$PLUGIN_DIR" || true openclaw plugins enable smartlead || true else echo "openclaw CLI not found. Skipping plugin install commands." fi ``` ### Technical Analysis The setup script links and enables an OpenClaw plugin from the fixed absolute path `/home/worker/code/openclaw-smartlead`. That plugin is outside the audited project, which contains only `SKILL.md` and `setup.sh`; therefore, its source, integrity, provenance, and credential-handling behavior cannot be verified from this artifact. Linked installation also means subsequent modifications at the external path may alter the code executed by OpenClaw without changing the reviewed Skill. Any user or process capable of writing to that path could replace or modify the plugin. The `|| true` clauses suppress installation and enablement errors, reducing visibility into partial or unexpected setup states. ### Attack Path 1. An attacker, compromised build process, or another local user gains write access to `/home/worker/code/openclaw-smartlead`. 2. The attacker places a malicious plugin there or modifies the expected plugin. 3. The user executes `setup.sh`. 4. The script links the external directory and enables the plugin without verifying its identity or integrity. 5. OpenClaw loads the unverified plugin. 6. The plugin can process Smartlead webhook content and may gain access to data or capabilities exposed to plugins by the OpenClaw runtime. ### Impact Assessment Successful exploitation could execute attacker-controlled plugin code with the privileges of the OpenClaw process. Depending on ...[truncated 491 chars]
• Remediation: ## Remediation Suggestions - Include the plugin source within the reviewed project or retrieve it through a versioned, authenticated dependency mechanism. - Resolve a bundled plugin relative to the setup script instead of using a fixed external path. - Pin the plugin to a reviewed version or commit and verify a cryptographic checksum or signature before installation. - Validate that the plugin directory and files are not writable by untrusted users. - Avoid linked/development-mode installation in production environments. - Remove `|| true`; fail closed and display actionable errors if installation or enablement fails. - Review the plugin separately for secret handling, webhook authentication, payload sanitization, outbound network destinations, and runtime permissions.

T08 · Insecure Dependencies

Note

• Location: setup.sh:84
• Finding: Unpinned Third-Party CLI Installation Guidance## Vulnerability Details **File Location**: `setup.sh`, lines 84–91 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Low **Vulnerable code:** ```bash echo "Optional: install smartlead-cli for manual debugging (not required by the plugin):" if command -v uv >/dev/null 2>&1; then echo " uv tool install smartlead-cli" elif command -v pip3 >/dev/null 2>&1; then echo " pip3 install --user smartlead-cli" else echo " (uv/pip3 not found)" fi ``` ### Technical Analysis The setup helper recommends installing `smartlead-cli` without pinning a reviewed version or providing an integrity hash. These commands are printed rather than automatically executed, which limits immediate exploitability. However, a user following the instructions will resolve whichever package version the configured package index currently serves. This creates supply-chain exposure to a compromised future release, package-index compromise, dependency compromise, or package-source misconfiguration. The CLI is especially sensitive because the Skill directs it to use `SMARTLEAD_API_KEY` and access lead and message-history data. ### Attack Path 1. A malicious or compromised `smartlead-cli` release becomes available through the user's configured Python package source, or that source is redirected to an unsafe repository. 2. The user follows the setup helper's printed `uv` or `pip3` command. 3. The package manager installs the unpinned release. 4. Package installation hooks or later CLI execution run compromised code under the user's account. 5. During CLI use, malicious code could attempt to access the Smartlead API key, configuration files, command inputs, or returned customer data. ### Impact Assessment Exploitation could result in code execution with the installing user's privileges. Because the CLI is intended to handle `SMARTLEAD_API_KEY`, lead records, email addresses, and message history, a compromised package could ...[truncated 330 chars]
• Remediation: ## Remediation Suggestions - Pin `smartlead-cli` to a specific reviewed version. - Install from an authenticated, documented package source. - Use a lockfile or hash-verified installation, such as pip hash checking, to ensure artifact integrity. - Document the authoritative package publisher and expected package identity. - Review the pinned package and its transitive dependencies before recommending it for environments containing Smartlead credentials. - Prefer an isolated tool environment with only the minimum required filesystem and environment-variable access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description says the skill manages Smartlead campaigns, leads, and webhooks via the smartlead CLI. However, this code chunk does not implement those management operations. It is a setup script focused on OpenClaw integration: installing a plugin, showing OpenClaw hooks/plugin configuration, describing webhook payload examples, and wiring Smartlead EMAIL_REPLY webhooks into an agent/slack workflow. While it mentions optional installation of smartlead-cli for debugging, the primary behavior is webhook/plugin setup rather than command-line management of Smartlead resources. That is a material description-behavior mismatch.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Deletion Behavior

Delete commands prompt for confirmation in interactive shells. In scripts/automation, pass `--yes`
to skip prompts.

Examples:

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.