T08 · Insecure Dependencies
Error
- Location
SKILL.md:15- Finding
Required Installation of an Unpinned External Plugin with Safety Checks Bypassed
- Content
View full analysis
- Remediation
View remediation
Security audit
Resilience Monitor
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent for resilience monitoring, but it requires installing unaudited external plugin code with unsafe-install bypass and includes a dashboard rendering bug that could expose or alter monitoring data.
Install only if you trust the `@leiJack-lo/resilience` plugin publisher and are comfortable bypassing OpenClaw's unsafe-install protection. Review the plugin source or use a pinned reviewed release if available, enable conversation access only when session recovery is needed, and avoid exposing the dashboard beyond loopback until the unsafe `innerHTML` rendering is fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
dashboard/app.js:204- Finding
Stored DOM-Based Cross-Site Scripting in Dashboard API Rendering
- Content
View full analysis
All instances (aggregated)' + (instances || []) .map( (i) => `${i.label}${i.id === local ? " · Local" : ""}${i.isLegacy ? " (legacy)" : ""}` ) .join(""); ``` Error records are rendered through `innerHTML` without encoding API-provided fields: ```js el.innerHTML = errors .map((e) => { const t = new Date(e.timestamp).toLocaleTimeString(); const tag = e.instanceLabel ? `${e.instanceLabel}` : ""; return `- ${tag}[${t}] ${e.errorLabel || e.errorType}: ${(e.errorMessage || "").slice(0, 50)}
`; }) .join(""); ``` Session recovery records are handled in the same way: ```js listEl.innerHTML = records .slice(0, 12) .map((r) => { const time = new Date(r.updatedAt || r.createdAt).toLocaleTimeString(); const tag = r.instanceLabel ? `${r.instanceLabel}` : ""; const statusClass = r.status === "manual_required" || r.status === "failed" ? "danger" : r.status === "queued" || r.status === "retrying" ? "warn" : "ok"; const target = r.toolName || r.taskId || r.runId || r.sessionKey || "session"; return `- ${tag}${STATUS_LABELS[r.status] || r.status} ${SESSION_LABELS[r.category] || r.category} ${time} · ${target} · ${r.attempt}/${r.maxAttempts}
`; }) ...[truncated 3239 chars]${(r.errorMessage || "").slice(0, 120)}
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill advertises very generic Chinese trigger phrases such as opening a dashboard or viewing today's error stats, without any clear namespace, confirmation step, or boundary indicating when these should map to tool invocation. In an agent environment, broad natural-language triggers can cause accidental or prompt-injected activation of tools, especially because some actions open a browser, stop services, or modify retry configuration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file hard-codes user-facing labels, status messages, prompts, and error text in Chinese throughout the dashboard, with no language selection, fallback, or documented locale constraint. This creates a natural-language policy issue because the skill effectively forces a specific language on all users without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description says the skill "Provides Chinese natural language interface only," which imposes a language restriction as a policy choice rather than offering the user a language option. The file does not document user opt-in or a justified region-specific requirement for this locale limitation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill defines several broad natural-language trigger phrases that all map directly to opening a dashboard, which increases the chance of accidental invocation from ordinary conversation. If the dashboard tool opens a local or remote web UI, unintended activation could expose operational data, trigger side effects, or create user-confusion and consent issues.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Saying the skill can be controlled using 'everyday language' encourages unconstrained matching from free-form user text to operational tools. While this is not directly malicious, it increases the attack surface for unintended tool calls from ambiguous conversation or adversarial prompt content embedded in other inputs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The page declares
lang="zh-CN"and all visible interface text is presented only in Chinese, which indicates a fixed language/locale choice. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.- Content