Security audit

SkillGate Governance

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: the skill is purpose-aligned, but it runs downloaded npm code and is unclear about when it may disable or quarantine skills.

Before installing, verify the npm package and source, prefer a sandbox or clean environment for scans, and confirm whether /gov scan only reports findings or can automatically disable/quarantine skills. Use quarantine/restore only when you are comfortable with persistent changes to your OpenClaw skills.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Automatic Retrieval and Execution of an Unverified Third-Party npm Package
Content: View full analysis
We intentionally avoid global installs (`npm i -g`) to reduce supply-chain risk. > Use a pinned version via `npx` for deterministic behavior. ```bash # Scan current workspace (read-only by default) npx --yes @skillgate/openclaw-skillgate@0.1.3 gov_scan . # Show a human-readable explanation for a finding npx --yes @skillgate/openclaw-skillgate@0.1.3 gov_explain ``` ### Technical Analysis The documented quick-start procedure uses `npx --yes` to retrieve and immediately execute `@skillgate/openclaw-skillgate@0.1.3` from the configured npm registry. The `--yes` option suppresses the normal installation confirmation, reducing the opportunity for the user to inspect the package before execution. Pinning the version improves reproducibility but does not independently authenticate the retrieved artifact. Although the document shows commands for displaying `dist.integrity`, it does not provide a trusted expected integrity value or require verification before execution. The project contains only `SKILL.md`; the source code of the executed npm package is not included. Consequently, the audit cannot verify the claims that scanning is read-only, that secrets are not accessed, or that no network traffic occurs after installation. This finding does not establish that the named package is malicious. It identifies the trust boundary created by downloading and executing unaudited third-party code. ### Attack Path 1. A user follows the Quick Start instructions in `SKILL.md`. 2. `npx --yes` contacts the configured npm registry and downloads the specified package if it is not already available locally. 3. npm lifecycle behavior and the requested CLI entry point execute code supplied by that external package. 4. The ...[truncated 1336 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The local development example uses npx gov_scan . without a pinned package reference, so execution may resolve to an unpinned or unexpected binary depending on the environment. In a supply-chain governance skill, this is more dangerous because users are being taught to trust a security tool, and an attacker who can influence package resolution or a local binary could cause arbitrary code execution or misleading scan results.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.