Ldm Openclaw Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This is a policy-style deliverability skill that coherently asks an agent to run a configured LDM email preflight before bulk outbound sends, with no hidden code or persistence beyond normal skill installation.

Before installing, confirm you trust the LDM service and the configured LDM_API_BASE because outbound campaign subjects, bodies, sender identities, links, and provider targeting may be submitted for checking. Maintainers should pin the clawhub CLI version in distribution commands, but ordinary use of this artifact is a disclosed policy integration rather than a hidden executable component.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Potential disclosure of sensitive campaign data to a configurable external endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-72
Vulnerability Type: Configurable external transmission of potentially sensitive data
Risk Level: Medium

Vulnerable Code

markdown

Set these environment variables:

```bash
LDM_API_BASE=https://check.live-direct-marketing.online
LDM_API_KEY=your_ldm_api_key
LDM_INBOX_THRESHOLD=70

text

```markdown
When the user asks to send or schedule outbound email:

1. Draft or collect the final subject, sender domain, sender mailbox, HTML/text body, links, and target provider mix.
2. Run the LDM preflight check.
3. If the result passes, summarize the result and continue.
4. If the result fails, do not send. Report the top deliverability risks and concrete changes.
5. After changes, run the check again before sending.

Technical Analysis

The Skill instructs the Agent to collect the complete subject, sender identity, message body, links, and provider targeting before invoking an external deliverability service. The service endpoint is controlled through LDM_API_BASE, but the reviewed files do not require origin allowlisting, HTTPS enforcement, redirect validation, payload minimization, or explicit approval before campaign information is transmitted.

The affected information may include confidential recruiting messages, investor updates, partnership communications, deal-flow notifications, unpublished links, sender mailbox details, and other business context. Although using an external service is consistent with the declared purpose of the Skill, allowing the destination to be changed without documented validation creates an avoidable disclosure risk.

The package contains no executable implementation, so the exact HTTP payload and runtime validation behavior cannot be verified from this repository. Exploitation therefore depends on the host Agent or an external integration implementing the documented preflight workflow and using the ...[truncated 1598 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict LDM_API_BASE to a documented allowlist of trusted HTTPS origins.
2. Reject non-HTTPS URLs, embedded credentials, unexpected ports, IP-literal destinations, and malformed endpoint values.
3. Disable cross-origin redirects or validate every redirect destination against the same allowlist.
4. Require explicit user confirmation before transmitting message bodies, sender identities, or private links to an external service.
5. Document the exact fields transmitted, the service operator, retention period, deletion process, and applicable privacy policy.
6. Minimize the payload by omitting recipient data and redacting personal information, credentials, tracking parameters, internal URLs, and unrelated message content.
7. Add a local-only analysis mode for checks that do not require remote processing.
8. Ensure the eventual implementation never logs API keys or complete campaign payloads and uses bounded request timeouts and certificate validation.
9. Clearly warn users when a non-default endpoint has been configured.

T08 · Insecure Dependencies

Warning

• Location: DISTRIBUTION.md:11

Finding

Unpinned npm package execution in distribution instructions

Content

View full analysis

Vulnerability Details

File Location: DISTRIBUTION.md, lines 11-17
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx -y clawhub login
npx -y clawhub whoami

bash

npx -y clawhub skill publish /root/ldm-openclaw-skill --version 1.0.0 --clawscan-note "This skill provides outbound deliverability preflight instructions and may call the user-configured LDM API only when the user configures LDM_API_KEY."
npx -y clawhub skill publish /root/ldm-openclaw-inbox-mcp-skill --version 1.0.0 --clawscan-note "This skill uses the ldm-inbox-check-mcp MCP server via npx and requires INBOX_CHECK_API_KEY. It creates paid/quota-backed inbox placement tests only for user-approved outbound preflight workflows."

Technical Analysis

The distribution guide uses npx -y clawhub without an exact package version, lockfile, or integrity verification. If the package is absent locally, npx can resolve, download, and immediately execute the package selected by the npm registry. The -y option suppresses the normal installation confirmation.

As a result, the code executed by these instructions can change independently of the audited repository. A compromised package, npm account, registry response, or future malicious release could execute arbitrary installation hooks or command-line logic under the publisher's account.

This risk primarily affects maintainers who follow the publishing documentation rather than ordinary users installing the policy-only Skill.

Attack Path

1. An attacker compromises the npm package, its maintainer account, its dependency chain, or the package-resolution path.
2. The attacker publishes a malicious version that is selected by the unpinned npx command.
3. A project maintainer follows DISTRIBUTION.md and runs npx -y clawhub login, whoami, or skill publish.
4. npx downloads and executes the selected package withou ...[truncated 1200 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an audited exact version, such as npx --yes clawhub@X.Y.Z, rather than resolving the current package release.
2. Prefer declaring the CLI in a development dependency with an exact version and committing the package lockfile.
3. Install dependencies using npm ci so resolution follows the reviewed lockfile.
4. Verify npm package provenance and integrity before execution.
5. Review the pinned package and its transitive dependencies before upgrades.
6. Run publishing operations in an isolated, short-lived, least-privilege environment.
7. Provide publishing credentials only for the duration of the command and scope them to the minimum required permissions.
8. Avoid running the publishing CLI as root; use a dedicated unprivileged publishing account.
9. Remove -y where interactive confirmation is appropriate, while recognizing that confirmation alone does not replace version pinning and integrity validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx -y clawhub login without pinning an exact package version causes the latest published clawhub package to be fetched and executed at runtime. If the package is compromised, typosquatted, or a malicious version is published, anyone following these instructions could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

npx -y clawhub whoami executes an unpinned package version from the registry, which introduces a supply-chain risk because the resolved code can change over time. A compromised upstream release would run locally with the user's permissions before the user can inspect it.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The publish command uses npx -y clawhub skill publish ... without a pinned version, so the documentation instructs users to download and execute whatever clawhub version is current at execution time. Because this command is part of a release workflow, compromise of the package could affect credentials, published artifacts, or repository contents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This publish command again relies on unpinned npx -y clawhub, creating the same risk of arbitrary code execution from a changed or malicious upstream package. The surrounding text also references an MCP-backed workflow, which may lead operators to run additional tooling and handle API keys, increasing the sensitivity of the environment where the command is executed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This publish command again relies on unpinned npx -y clawhub, creating the same risk of arbitrary code execution from a changed or malicious upstream package. The surrounding text also references an MCP-backed workflow, which may lead operators to run additional tooling and handle API keys, increasing the sensitivity of the environment where the command is executed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

Copy this folder into your OpenClaw skills directory:

bash

mkdir -p ~/.openclaw/skills
cp -R ldm-openclaw-skill ~/.openclaw/skills/ldm-deliverability-check

Static analysis

No suspicious patterns detected.