ClawHub
Back to skill

Security audit

iGOT Karmayogi Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is an iGOT course automation tool, but it can autonomously change a government training account, submit assessments, and persist session state with too little user control.

Install only if you explicitly want an agent to operate your authenticated iGOT account, including enrolling in courses and submitting assessments for you. Review whether this is allowed by your organization, avoid using it on shared machines, and prefer a version that requires confirmation before enrollment, assessment submission, certificate download, and session resume.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:31
Finding

Autonomous Agent Control and Output Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–49; supporting directives at lines 416–422 and 461–471
Vulnerability Type: Agent instruction and communication-policy hijacking
Risk Level: High

Vulnerable Code

text
Every rule is written as a SHORT, DIRECT command. Follow each line exactly.
When in doubt: take a screenshot, read the screen, then act.

---

## RULE 1 — NEVER STOP

The single most important rule:

DO NOT stop between steps. DO NOT wait for the user to message you. DO NOT pause after completing an action. DO NOT ask "should I continue?" — just continue. The only times to stop and wait for user: - Initial login confirmation (say "go") - Error after 3 retries - User types "pause" or "stop"

text

Additional restrictive instructions include:

text
RULE V1: While waiting for a video, the ONLY valid actions are:
  - Take screenshot
  - Read timer value
  - Click play if paused
  - Run RECOVERY if page is broken
  - Wait 30 seconds
  NOTHING ELSE. Do not navigate away. Do not check other things.
text
## NOTIFICATIONS — Only These, Nothing Else

Technical Analysis

The skill uses priority-like commands to alter the Agent's normal decision-making and communication behavior. It demands exact compliance, directs the Agent not to stop or request confirmation, restricts valid actions during part of the workflow, and limits user-facing notifications.

These instructions are particularly consequential because the workflow operates within an authenticated government training account and performs state-changing actions, including course enrollment, assessment submission, multi-course processing, and certificate download. The instructions do not establish consent checkpoints before these actions. Instead, they direct the Agent to continue automatically until the entire course queue has been processed.

The fixed notification pol ...[truncated 1961 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove priority-like phrases such as “Follow each line exactly,” “NEVER STOP,” “ONLY valid actions,” and “Nothing Else.”
  2. State explicitly that platform safety policies, user instructions, and informed consent take precedence over workflow automation.
  3. Require explicit confirmation before:
    • Enrolling in a course.
    • Submitting any practice or final assessment.
    • Consuming an assessment retry.
    • Downloading a certificate.
    • Continuing to another course.
  4. Present the complete course queue and proposed actions before execution.
  5. Replace the fixed notification allowlist with minimum notification requirements that do not prohibit additional safety-relevant communication.
  6. Provide a dry-run or read-only mode that reports courses and progress without modifying account state.
  7. Make interruption immediate rather than requiring the current item to finish.
  8. Record user authorization for each consequential action in local state so a resumed session cannot infer stale consent.
  9. Ensure assessment automation complies with the portal's rules and applicable organizational policies; otherwise require the user to complete assessments personally.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:121
Finding

Unpinned Dynamic Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121–125
Vulnerability Type: Unsafe runtime dependency resolution and execution
Risk Level: Medium

Vulnerable Code

text
If browser tool fails:
  → Try: playwright-mcp launch
  → If that fails: exec: npx playwright open https://portal.igotkarmayogi.gov.in/page/home
  → If all fail: message user "Run: openclaw gateway restart then say 'retry'"

Technical Analysis

The fallback invokes npx playwright without specifying an exact package version, lockfile, integrity hash, approved registry, or requirement that the package already be installed. Depending on the local npm and npx configuration, this command can dynamically resolve, download, and execute package code from an npm registry.

This creates a supply-chain trust boundary at runtime. The effective executable can change after the skill has been reviewed because package resolution depends on the registry, local configuration, cache state, package tags, and available versions. A compromised upstream package or registry response could therefore cause unintended code to execute with the permissions of the Agent process.

The command uses a fixed portal URL and does not directly interpolate user input, so no command-injection condition was identified in the documented command itself. The vulnerability is the unpinned and potentially remote dependency execution mechanism.

Attack Path

  1. The normal OpenClaw browser launch fails.
  2. The playwright-mcp fallback also fails or is unavailable.
  3. The Agent executes npx playwright open ....
  4. npx searches the local environment and configured npm registry for the requested package.
  5. If an acceptable local package is unavailable, npx may download a package selected at execution time.
  6. Package lifecycle or command code executes under the Agent's local user account.
  7. If the resolved dependency or registry is compromised, that ...[truncated 864 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove runtime package installation and execution from the fallback path.
  2. Require a preinstalled, audited Playwright executable from a controlled installation location.
  3. If npm installation is unavoidable:
    • Pin an exact package version.
    • Commit and enforce a lockfile.
    • Verify package integrity hashes.
    • Use an approved, authenticated registry.
    • Disable lifecycle scripts where operationally possible.
    • Install during a controlled build or provisioning phase, not during skill execution.
  4. Invoke the verified local binary directly rather than using npx package resolution.
  5. Run browser automation under a dedicated, least-privileged operating-system account.
  6. Restrict filesystem and network access available to the browser-launch process.
  7. Fail safely and request administrator remediation when the trusted browser tooling is unavailable instead of downloading executable dependencies dynamically.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises fully autonomous operation for playing videos, completing assessments, and downloading certificates, but does not warn users that it will submit answers on their behalf. In this context, that is especially dangerous because it automates credential- or compliance-related actions on a government training platform and may violate policy, misrepresent user knowledge, or create accountability issues.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

  1. If queue empty: → Message: "🎓 All [N] courses complete! Certs in ~/Downloads/iGOT-Certificates/" → Delete state file: ~/.openclaw/workspace/igot-state.json → Close browser
text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to invoke a high-autonomy skill from casual language such as 'play the videos' or 'continue my paused course.' Because the skill can log into a user account context, navigate courses, answer assessments, and download files, over-broad activation materially raises the risk of unintended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description omits that it writes persistent state to ~/.openclaw/workspace/igot-state.json and saves certificates to local storage. That lack of disclosure matters because the state file contains detailed course names, progress, and identifiers that may expose sensitive employment or training information on a shared host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Persisting state after every action enables autonomous cross-session continuation of account activity, especially when combined with a persistent browser profile and instructions to 'never stop.' In this skill, that means the agent can continue through courses and assessments with minimal user interaction, increasing the risk of unintended or unauthorized actions if the environment is reused.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

RULE 2 — SAVE STATE AFTER EVERY ACTION

Because this model may lose context mid-task, write the current state to a file after every completed action:

text

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The state file design persists granular course and activity data after every action, including course IDs, module names, item indices, and timestamps. Persistent accumulation of this data increases privacy risk, enables cross-session tracking, and can leak sensitive learning or employment-related information if the host is shared or later compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to run local shell commands and manipulate files (cat on a workspace state file, alternate local launch commands) even though its stated purpose is website automation. Expanding from browser-only behavior into host command execution increases the attack surface and can be abused to access or alter local state in ways users may not expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill resumes prior sessions by reading saved state and navigating directly back into an authenticated workflow. Session persistence becomes more dangerous here because the skill uses a persistent browser profile and autonomous continuation, which can let actions resume on behalf of a user without a fresh confirmation of intent or account context.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
exec: cat ~/.openclaw/workspace/igot-state.json

   If file exists and phase is NOT "launch_browser":
     → Read saved state
     → Launch browser (step 2)
     → Navigate directly to saved position
     → Resume from saved phase

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill includes a fallback to execute npx playwright, which pulls and runs tooling from the local/npm environment without any version pinning or integrity control. That creates supply-chain and execution-risk exposure beyond the managed browser, especially because this skill is designed to run autonomously and may invoke the fallback without meaningful user review.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to collect all courses from dashboard sections, sort them by due date, and report queue details back to the user. This broad collection and disclosure of learning assignments and progress exceeds the minimum needed for many tasks and can expose sensitive workplace training status or deadlines.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation claims 'No external connections' while the skill's core behavior is logging into and automating a remote government portal. This is a deceptive or inaccurate trust signal that can mislead reviewers and users about the network exposure and data-sharing implications of using the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline statement 'No external connections' directly contradicts the explicit browser navigation workflow to external URLs. Contradictory security documentation is dangerous because it lowers operator suspicion and can cause the skill to bypass scrutiny it would otherwise receive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The selector reference explicitly instructs checking localStorage for a persisted JWT-containing userDetails object to verify authenticated session state. In a skill that runs autonomously in a managed browser for a government learning portal, documenting direct access to session artifacts normalizes handling sensitive auth state and can lead downstream implementations to read, log, persist, or misuse tokens outside the browser's normal security boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.