Security audit

Skillstore

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says, but it can persistently install third-party GitHub code into the local skills directory with too little review or warning.

Install only if you understand that selecting a GitHub result may write third-party skill code into your local skills directory. Prefer trusted repositories, inspect the repo and target path first, and keep a way to remove the installed skill if it behaves unexpectedly.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented interaction flow says that entering a number installs a GitHub result, but it does not explicitly warn the user that this action pulls and installs code from a remote repository. That omission can lead users to execute untrusted third-party code with the authority of the OpenClaw environment, increasing supply-chain and remote code execution risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This code installs untrusted code from GitHub by cloning a repository directly into the local skills directory after only a numeric selection, with no explicit trust prompt, publisher verification, or review step. In a skill ecosystem, this is dangerous because a malicious repository can introduce arbitrary code or follow-on execution paths once the installed skill is later used.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: main.js:282