kkclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:32 PM UTC
• Version: 3.1.2

Overview

The skill describes a coherent OpenClaw desktop companion, but its install path asks users to run mutable external code that manages sensitive provider and voice settings.

Review the kkclaw repository and release provenance before installing. Prefer a pinned commit or signed release, inspect package scripts and dependencies, and run it with only the OpenClaw, provider, Gateway, TTS, and voice data access you are comfortable granting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned External Application and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-54; references/setup.md, lines 10-13
Vulnerability Type: Unverified, mutable third-party source and dependency execution
Risk Level: Medium

Affected code in SKILL.md (lines 51-54):

bash

git clone https://github.com/kk43994/kkclaw.git
cd kkclaw
npm install
npm start

Affected code in references/setup.md (lines 10-13):

bash

git clone https://github.com/kk43994/kkclaw.git
cd kkclaw
npm install
npm start

Technical Analysis

The installation instructions clone the mutable default branch of an external GitHub repository and immediately install and execute its contents. No reviewed commit hash or signed release is pinned, and the documentation provides no checksum, signature verification, lockfile enforcement, or dependency validation procedure.

Running npm install can execute lifecycle scripts from the root project or its transitive packages. Running npm start then executes application code obtained from the external repository. Consequently, the effective code executed by a user can change after this Skill has been audited. The executable source code and dependency manifests are not included in the audited artifact, so their safety cannot be established from the available files.

This is an insecure supply-chain pattern rather than evidence that the referenced repository is currently malicious.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or one of the application's dependencies.
2. The attacker adds malicious code to the mutable default branch or introduces a malicious package or lifecycle script into the dependency graph.
3. A user follows the documented commands and clones the altered repository.
4. npm install executes an attacker-controlled lifecycle script, or installs a malicious dependency.
5. Alternatively, npm start executes the altere ...[truncated 829 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specifically reviewed commit hash or cryptographically signed release rather than cloning and executing the mutable default branch.
2. Include the executable source, package.json, and lockfile in the audited Skill artifact so the complete installation path can be reviewed.
3. Commit a trusted lockfile and use npm ci instead of npm install to enforce the resolved dependency graph.
4. Publish SHA-256 checksums and cryptographic signatures for release installers, and document explicit verification commands.
5. Review package lifecycle scripts and use npm ci --ignore-scripts where lifecycle scripts are not required. If scripts are required, document and audit each one before execution.
6. Add automated dependency scanning, provenance checks, and lockfile integrity validation to the release process.
7. Recommend installation and execution under a dedicated, least-privileged account without unnecessary access to unrelated credentials or files.
8. Pin documentation examples to an immutable version and provide a controlled update procedure for moving to newer reviewed versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly advertises voice broadcasting and voice cloning capabilities but provides no warning about consent, impersonation risk, or handling of biometric voice data. In a desktop agent context, these features can enable privacy violations or deceptive use if users are not clearly informed about recording, cloning, and playback boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all installation and usage instructions exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language is offered. The policy specifically calls for flagging skills that force a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.