Openclaw Path Alerts Main

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

This is a straightforward PATH transit alert helper with dependency and data-handling hygiene issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable with a Node skill that makes live outbound requests to public PATH transit feeds. The publisher should update or pin dependencies, add explicit network scope, sanitize remote alert text before rendering, and report upstream feed failures as unavailable instead of normal service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:91

Finding

Untrusted Remote Alert Content Is Embedded Directly into Agent-Facing Markdown

Content

View full analysis

0) msg += `📍 Lines: ${lines.join(', ')}\n`; if (desc) msg += `\n${desc}\n`; return msg; } ``` ### Technical Analysis The Skill retrieves incident records from an external API and copies the remote `title`, `description`, `details`, and `affectedLines` fields directly into Markdown-formatted output. It does not validate the response schema, constrain field lengths, escape Markdown control characters, remove active links or mentions, or distinguish remote content from trusted agent instructions. Although the expected upstream data is transit information, it crosses an external trust boundary. If an upstream publishing account, API, intermediary, or incident record is compromised, an attacker could place instruction-like content or misleading Markdo ...[truncated 1738 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:35

Finding

Upstream Failures Are Misreported as Normal Service or No Upcoming Trains

Content

View full analysis

{ const code = lineCode.toUpperCase(); return (a.affectedLines || []).some(l => l.includes(code)) || (a.title || '').toUpperCase().includes(code); }) : alerts; if (filtered.length === 0) { const lineText = lineCode ? ` for ${lineCode}` : ''; return `✅ No current PATH service alerts${lineText}. All lines operating normally.`; } const lineText = lineCode ? ` for ${lineCode}` : ''; let msg = `🚊 **PATH Service Alerts${lineText}** (${filtered.length} active)\n\n`; msg += filtered.map(formatAlert).join('\n---\n\n'); return msg; } ``` ```javascript export async function getGtfsFeed() { const now = Date.now(); if (cachedFeed && (now - cacheTime) < CACHE_TTL) { return cachedFeed; } try { const response = await fetch(GTFS_RT_URL); if (!response.ok) { throw new Error(`GTFS-RT fetch failed: ${response.status}`); } const buffer = await response.arrayBuffer(); const feed = GtfsRealtimeBinding ...[truncated 2510 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Known Vulnerable Dependency: brace-expansion==2.1.1 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

brace-expansion 2.1.1 is flagged with multiple DoS advisories affecting expansion behavior. Even though this is a lockfile entry and likely a transitive dependency via minimatch/glob used by protobufjs-cli, shipping a known vulnerable package is still a real supply-chain risk if attacker-influenced patterns are processed during runtime or tooling execution. In this skill context, the dependency appears incidental rather than core to PATH alerts, which makes malicious intent unlikely but also suggests the package can likely be removed or upgraded.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: linkify-it==5.0.1 — 1 advisory(ies): CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

linkify-it 5.0.1 is reported vulnerable to quadratic-complexity DoS in mailto parsing. In this lockfile it is pulled in through markdown/jsdoc tooling under protobufjs-cli, so it is probably not part of the PATH alert skill's normal runtime path; that reduces exploitability, but if documentation parsing or markdown handling is exposed to untrusted input in deployed environments, crafted content could cause excessive CPU consumption.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill explicitly depends on internet access and external APIs, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where network use is implicit rather than constrained, making it harder for the platform or users to enforce least privilege and increasing the risk of unintended outbound requests if the implementation changes or is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation text is fairly broad for natural-language routing, using phrases like asking about PATH trains, delays, or service status. This can cause the skill to trigger on general transit queries and capture requests outside its intended scope, which may lead to unexpected network calls or incorrect handling rather than direct compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==8.6.3 — 2 advisory(ies): CVE-2026-59877 (protobufjs: Denial of Service via infinite loop in .proto option parsing); CVE-2026-59876 (protobufjs: Text Format string map parsing can mutate returned map object protot)

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

protobufjs 8.6.3 is flagged for a .proto parsing DoS and a text-format map parsing issue with possible object mutation/prototype-related side effects. Because this skill consumes GTFS-Realtime protobuf data, protobufjs is closer to functional runtime use than the other findings, so the skill context makes this more relevant: malformed or attacker-controlled protobuf/text inputs could potentially trigger service disruption or unsafe object behavior depending on how parsing APIs are used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency uses a caret version range (^2.0.0), which allows npm to install newer compatible releases automatically. This can introduce supply-chain risk if an upstream package is compromised or a future release contains a breaking or vulnerable change, although in this simple transit-alert skill the issue is limited to dependency hygiene rather than evidence of active malicious behavior.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"author": "",
  "license": "ISC",
  "dependencies": {
    "gtfs-realtime-bindings": "^2.0.0"
  }
}

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill says it activates when a user asks about 'PATH trains, delays, or service status,' which is broad natural-language phrasing rather than a tightly constrained invocation rule. Although examples are provided, there are no explicit exclusion conditions or negative examples clarifying when ordinary transit conversation should not invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.