AIOS App Service

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.3

Overview

The skill is meant to call live AIOS/OpenClaw business systems and has some guardrails, but it needs review because it can be invoked implicitly and includes an unpinned npx fallback for a command that handles real business operations.

Install only in an environment where implicit live business-system reads are acceptable, mutating actions are independently controlled by user confirmation and backend authorization, and `aios-apps-invoke-cli` is supplied from a pinned, trusted installation rather than downloaded through unversioned npx at runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/invoke-rules.md:13

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/invoke-rules.md, line 13
Vulnerability Type: Unsafe execution of an unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

markdown

If the global command is unavailable, use `npx aios-apps-invoke-cli ...`.

The original instruction is:

markdown

全局命令不可用时，可使用 `npx aios-apps-invoke-cli ...`。

Technical Analysis

The fallback executes aios-apps-invoke-cli through npx without specifying an exact package version, integrity digest, lockfile, or trusted registry. If the package is not already available in a trusted local cache, npx can download and immediately execute the package and its dependency lifecycle code.

Consequently, the code ultimately executed can change after the Skill has been reviewed. Security depends on the current npm package release, its transitive dependencies, registry resolution, and local npm configuration rather than solely on the audited project contents.

This creates a software supply-chain risk. Exploitation could occur if the package or one of its dependencies is compromised, ownership is transferred to a malicious party, a malicious version is published, or npm is configured to use an attacker-controlled registry. The project contains no evidence that such a compromise has occurred; the vulnerability is the unsafe unpinned execution mechanism.

Attack Path

1. The expected globally installed aios-apps-invoke-cli command is unavailable.
2. The Agent follows the documented fallback and runs npx aios-apps-invoke-cli ....
3. npx resolves the unversioned package through the configured npm registry or cache.
4. A compromised package version or transitive dependency is downloaded.
5. Package or lifecycle code executes with the permissions of the Agent process.
6. The malicious code can access resources available to that process, potentially including request files, returned busin ...[truncated 894 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the ad hoc npx fallback and require a preinstalled, administrator-managed, audited CLI.
2. If npx is operationally necessary, pin an explicitly approved exact version, for example aios-apps-invoke-cli@X.Y.Z; do not use version ranges or tags such as latest.
3. Verify package and dependency integrity through a reviewed lockfile and integrity hashes before execution.
4. Enforce the approved npm registry explicitly and prevent project, user, or environment-controlled registry overrides.
5. Disable lifecycle scripts where compatible, or audit every required lifecycle script before installation.
6. Install the approved dependency during a controlled build or deployment stage rather than downloading executable code at Skill runtime.
7. Run the CLI in a least-privilege sandbox with narrowly scoped filesystem, environment, network, and local-socket access.
8. Fail closed if the trusted CLI is unavailable instead of automatically resolving mutable third-party code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The entire skill description is written as a mandatory Chinese-language operating policy and does not indicate that users may choose another language or locale. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation for a capability that can read ontology data and trigger live AIOS application interface calls, but it defines no trigger constraints, scoping rules, or exclusion conditions. This creates a broad attack surface where ordinary user prompts may unintentionally or adversarially cause privileged business-system reads or operations, increasing the risk of unauthorized actions, data exposure, and prompt-injection-driven tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly includes scenarios where the skill will 'directly execute operations in the system' but provides no requirement for user confirmation, authorization checks, dry-run behavior, or side-effect warning. Because this skill is designed to invoke real business commands against live AIOS/OpenClaw/Forguncy systems, the omission materially increases the risk of unintended or unauthorized state-changing actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document title and all operational instructions are written as mandatory Chinese-language guidance, with no indication that users may choose another language or locale. This can violate organizational language/locale policy when a skill imposes a specific language by default rather than offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and all operational guidance are written as mandatory Chinese instructions, with no indication that other languages are supported or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The document explicitly allows falling back to npx aios-apps-invoke-cli ... without pinning a package version. That introduces supply-chain risk because execution may resolve to the latest published package version, which could change behavior unexpectedly or become malicious if the package or dependency chain is compromised. In this skill context, the risk is heightened because the CLI is used to invoke real business-system operations and process live session-scoped data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown instructs the skill to read AIOS_ONTOLOGY_DIR before every invocation. Accessing environment-derived configuration can reveal system context, but the description does not explicitly warn users that runtime environment information will be accessed as part of execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.