Security audit

Constraint Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local constraint-management aid that discloses its automatic checks, local file writes, and dependency needs, with no artifact evidence of exfiltration or hidden execution.

Install only if you want the agent to maintain local guardrails that can automatically check or block actions. Review generated constraints before activating them, use overrides deliberately, and verify or pin the referenced dependencies if your environment requires stronger supply-chain control.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 30-41 **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash openclaw install leegitw/constraint-engine ``` **Dependencies**: `leegitw/failure-memory` (for eligibility data) ```bash # Install with dependencies openclaw install leegitw/context-verifier openclaw install leegitw/failure-memory openclaw install leegitw/constraint-engine ``` ### Technical Analysis The installation instructions retrieve third-party skills by mutable package or repository names without specifying immutable versions, commit hashes, cryptographic checksums, or signature-verification requirements. Consequently, the artifacts installed by these commands may differ from those reviewed during this audit. The documented dependency installation procedure also installs `leegitw/context-verifier`, although the dependency declaration identifies only `leegitw/failure-memory` as required. This expands the supply-chain attack surface without clearly documenting why the additional component is necessary. This issue does not prove that the referenced packages are currently malicious. The risk arises because compromise of an upstream account, namespace, repository, release process, or package-resolution mechanism could cause future installations to retrieve altered content. ### Attack Path 1. An attacker compromises an upstream maintainer account, repository, package namespace, or release process associated with one of the referenced skills. 2. The attacker publishes a modified package under the same mutable identifier. 3. A user follows the installation commands in `SKILL.md`. 4. OpenClaw resolves and installs the attacker-controlled package because no immutable version or digest is required. 5. The modified skill is loaded or invoked within the agent environment. 6. Any malicious instructions or executable comp ...[truncated 832 chars]
Remediation: ## Remediation Suggestions 1. Pin every referenced skill to an immutable, reviewed version or commit hash rather than installing by a mutable repository identifier. 2. Publish and verify cryptographic checksums or signed provenance for each installed artifact. 3. Configure the installer to reject packages whose signatures, hashes, or expected source repositories cannot be verified. 4. Explicitly declare and justify `leegitw/context-verifier` as a dependency, or remove it from the installation procedure if it is unnecessary. 5. Maintain a lock file or equivalent dependency manifest containing exact resolved versions and integrity hashes. 6. Review dependency updates before changing pinned versions, including transitive dependencies and any bundled executable scripts. 7. Run installed skills with least privilege and restrict filesystem, network, tool, and environment access to reduce the consequences of a compromised dependency.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Exfiltration Commands

High

Category: Prompt Injection
Content: - Network resources or external APIs **What this skill does NOT do:** - Send data to external services - Execute arbitrary code - Modify files outside its workspace
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger condition is broad and ambiguous: 'pre-action or threshold reached' plus 'Next Steps (auto)' for `/ce check` and `/ce generate` could cause the skill to run automatically in many contexts. In a core enforcement skill that can block actions, write logs, and generate constraints from observations, unintended invocation can disrupt workflows or apply guardrails when the user did not explicitly request them.

External Transmission

Medium

Category: Data Exfiltration
Content: - Network resources or external APIs **What this skill does NOT do:** - Send data to external services - Execute arbitrary code - Modify files outside its workspace
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: **What this skill does NOT do:** - Send data to external services - Execute arbitrary code - Modify files outside its workspace **Dependency note:**
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Static analysis

No suspicious patterns detected.