AGENT SPM SKILL

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

This guide is transparent about installing an AI Guardian plugin, but it asks users to install an unpinned external package and enable remote testnet-based enforcement in the local gateway.

Review the external plugin source and pin a specific audited version before installing. Start in audit-only mode if supported, understand who controls the configured Chromia testnet deployment, and protect the generated private key because the plugin is configured to use it for signing.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.md:54

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 54-60
Vulnerability Type: Unpinned executable dependency
Risk Level: High

The installation guide directs users to install a third-party npm plugin without specifying an exact version, integrity hash, signature, or verified source revision.

bash

## Step 2: Install the Plugin

Run the following command to install the Agentic SPM via the OpenClaw CLI:

openclaw plugins install @chrguard/ai-guardian-plugin

Technical Analysis

The package version is not pinned, so the command resolves whatever version the package registry serves at installation time. Consequently, the code executed by users can differ from the code originally reviewed by the skill author or auditor.

The dependency's source is not included in the audited project. Its behavior, lifecycle scripts, transitive dependencies, and runtime access therefore cannot be verified from the available artifact. The subsequent instructions explicitly allow and enable the plugin, configure a private-key path, and restart the gateway, creating an execution path for the downloaded package.

This is a supply-chain risk rather than evidence that the current package is malicious. Exploitation would require compromise of the package, its maintainer account, the registry distribution path, or a future unsafe package release.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the package publication process.
2. The attacker publishes a malicious release under @chrguard/ai-guardian-plugin.
3. A user follows the guide and runs the unpinned installation command.
4. OpenClaw retrieves the attacker-controlled package version.
5. The user adds the package to the plugin allow list, enables it, and restarts the gateway.
6. The malicious plugin executes in the OpenClaw plugin context and may access resources available to that process, including configuration and the configure ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to an exact, reviewed version instead of resolving the latest release.
• Publish and verify a cryptographic integrity hash or signed release manifest before installation.
• Document the authoritative package registry and source repository.
• Include the plugin source or a reproducible-build reference in the audited artifact.
• Audit the package's lifecycle scripts, runtime entry points, and transitive dependencies.
• Use a lockfile or equivalent immutable dependency manifest where supported.
• Run the plugin under a dedicated, least-privileged account or sandbox.
• Restrict filesystem access so the plugin can read only the specific resources necessary for its documented operation.
• Establish an update-review process rather than permitting automatic installation of newly published versions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:101

Finding

Remote Testnet Infrastructure Granted Local Enforcement Authority

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 101-123
Vulnerability Type: Excessive trust delegated to external authorization infrastructure
Risk Level: Medium

The recommended configuration enables active enforcement and delegates judgment processing to fixed external Chromia testnet nodes.

json

"entries": {
    "ai-guardian-plugin": {
        "enabled": true,
        "config": {
            "enabled": true,
            "enforceDecision": true,
            "chromiaBrid": "5D007915E9DE53AA29784820E8F41CE65A4436703E23B8AF49B83C7FB4FDB048",
            "chromiaNodes": [
                "https://node6.testnet.chromia.com:7740",
                "https://node7.testnet.chromia.com:7740",
                "https://node8.testnet.chromia.com:7740"
            ],
            "chromiaJudgeOperation": "judge_action",
            "chromiaStatusQuery": "get_judgment_status",
            "chromiaFtAuth": false,
            "chromiaTxAwait": true,
            "timeoutMs": 15000,
            "chromiaTxTimeoutMs": 25000,
            "chromiaQueryTimeoutMs": 8000,
            "chromiaPollTimeoutMs": 30000,
            "chromiaPollIntervalMs": 1000,
            "chromiaSecretPath": "~/.config/ai-guardian/guard-client-key"
        }
    }
}

Technical Analysis

Setting enforceDecision to true places external judgment results in the local gateway's enforcement path. The configured endpoints are testnet services, but the guide does not document their authentication guarantees, operational ownership, production suitability, consensus assumptions, or behavior when nodes are unavailable or return inconsistent results.

The configuration also sets chromiaFtAuth to false. The artifact does not define this option, so it is not possible to conclude that transport or request authentication is disabled. Nevertheless, the setting should be explicitly documented and reviewed before enfo ...[truncated 1803 chars]

Remediation

View remediation

Remediation Suggestions

• Default enforceDecision to false and begin in audit-only mode.
• Require explicit, informed administrator approval before enabling active enforcement.
• Use production-grade, authenticated endpoints rather than testnet infrastructure for security-critical decisions.
• Document node ownership, trust assumptions, consensus requirements, and endpoint authentication.
• Define and document fail-open and fail-closed behavior for timeouts, inconsistent responses, and total node unavailability.
• Require agreement from multiple independently operated nodes before applying a blocking decision.
• Validate that responses correspond to the configured blockchain identifier, expected operation, request, and signer.
• Constrain enforcement to a documented allow list of action types and avoid granting the remote service broader authority than necessary.
• Clarify the security meaning of chromiaFtAuth and enable the appropriate authentication mechanism where supported.
• Add monitoring, decision logs, administrator override procedures, and rollback controls for incorrect judgments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.