T08 · Insecure Dependencies
Warning
- Location
install.sh:145- Finding
Unpinned Third-Party Skills Installed from a Remote Registry
- Content
View full analysis
- Remediation
View remediation
Security audit
Starter Flow
Security checks for vulnerabilities and agentic risk
Overview
This skill is an onboarding installer that broadly activates and installs multiple external skills by default, while under-disclosing that installation depends on the ClawHub registry.
Review the five named dependencies before installing, and treat this as a bulk remote skill installer rather than a purely local tool. Install only the skills you actually want, verify their publishers or versions if your OpenClaw setup supports that, and be aware that broad trigger phrases could invoke this flow during ordinary onboarding conversations.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase "新手启动" is very broad and presented as a natural-language activation command without any namespace, confirmation, or scope limitation. This can cause unintended invocation during normal conversation or make it easier for another prompt/context to steer the agent into installing or recommending multiple skills the user did not explicitly request through a trusted command channel.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes very broad everyday terms such as “新手”, “启动”, “starter”, and “第一次”, while metadata marks the skill priority as "critical". This increases the chance of accidental invocation during normal conversation, which could launch an installation flow or influence user actions without clear intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises that users can speak naturally and it will understand, but it does not define clear trigger boundaries, disambiguation rules, or safeguards against incidental matches. In a starter/install skill, ambiguous activation is more dangerous because it can steer users into installing multiple dependent skills or changing their environment unintentionally.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
At L039-L040 the script presents a safety statement saying '所有技能本地运行，无云端依赖' ('all skills run locally, no cloud dependency'). However, the installation logic at L145 runs 'clawhub install' for each selected skill, which implies fetching or installing skills from an external hub/service rather than purely local-only behavior. This is an active contradiction between the script's documentation-style claim and what the code does.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The UI offers a language choice at L062, but the implementation keeps Chinese as the default and responds to English selection with "English support coming in Phase 2..." at L093. This is a natural-language locale policy issue because the skill does not actually provide a real language choice or user opt-in for the Chinese-only experience.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger examples listed as “新手”, “启动”, and “starter” are generic everyday terms that can easily appear in unrelated conversations. In an agent skill context, overly broad triggers increase the chance of accidental invocation, causing the skill to activate outside user intent and potentially chain into installation or onboarding actions unexpectedly.
- Content