everyfile

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 2026.4.22

Overview

This skill is a disclosed Windows file-search helper, with some examples that require care because they can reveal sensitive paths or move files if a user runs them.

Install only if you are comfortable with a Windows search tool that can enumerate broad filesystem paths. Review matches before piping them into commands, be careful with sensitive files such as .env, and prefer a pinned or reviewed everyfile package version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16, SKILL.md:40, references/api.md:9, and references/cli.md:9
Vulnerability Type: Unpinned and integrity-unverified third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:16:

yaml

metadata: {"author": "LouisGameDev", "openclaw": {"os": ["win32"], "requires": {"bins": ["ev"]}, "install": [{"id": "pip", "kind": "pip", "package": "everyfile", "bins": ["ev", "every", "everyfile"], "label": "Install everyfile (pip install everyfile)", "os": ["win32"]}]}}

SKILL.md:38-42:

powershell

## Install

pip install everyfile

references/api.md:7-11:

powershell

## Install

pip install everyfile

references/cli.md:7-11:

powershell

## Install

pip install everyfile

Technical Analysis

The Skill directs the agent to install everyfile from the default pip package index without specifying an exact version, validating a package hash, or using a reviewed lockfile. The installation metadata likewise identifies only the mutable package name.

Consequently, the code installed and executed may differ from the version that existed when the Skill was audited. Python packages can execute code during installation or when their modules and command-line entry points are imported or invoked. If the package distribution, publisher account, or upstream release process is compromised, a later malicious release could be selected automatically.

This finding does not establish that the current everyfile package is malicious. The vulnerability is the absence of version and integrity controls around executable third-party content.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious release under the existing everyfile package name.
3. The agent loads the Skill on a Windows system where the required command ...[truncated 969 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin everyfile to an exact, reviewed version in both the installation metadata and all documentation, for example:

   powershell

   pip install everyfile==X.Y.Z
   

2. Distribute a requirements file containing an approved artifact hash and install it with hash enforcement:

   powershell

   pip install --require-hashes -r requirements.txt
   

3. Ensure the hash corresponds to a specifically reviewed wheel from a trusted package source.
4. Use a controlled internal package mirror or allowlist where feasible.
5. Record the verified package version, artifact filename, source repository, and integrity digest in the project.
6. Apply the same pin consistently to SKILL.md, references/api.md, references/cli.md, and the structured installation metadata.
7. Install and run the dependency under a non-administrative account with only the filesystem permissions required for legitimate searches.
8. Add automated dependency monitoring so version changes require explicit review rather than being selected implicitly at installation time.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation explicitly promotes searching for .env files, which commonly contain credentials, API keys, and secrets. In the context of an agent skill designed for broad, fast system-wide file discovery, this materially increases the risk of credential harvesting or accidental exposure because it normalizes locating sensitive secret-bearing files for 'audit' without guardrails or warnings.

Content

Scanner excerpt · references/api.md (reported line 129)May include surrounding context.

md

for row in top:
    print(f"{row.size:>12,}  {row.full_path}")

# Collect all .env files for audit
envs = ev.search("ext:env", fields="full_path", limit=500).fetchall()
paths = [Path(r.full_path) for r in envs]

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill manifest frames this skill as providing fast file and folder search via Everything, emphasizing finding, listing, and counting results. The API reference includes an example that persists results to disk with Path("results.json").write_text(...), which is not necessary to the core search capability and introduces an additional file-writing capability not justified by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes an example that creates or overwrites results.json via Path("results.json").write_text(...). The surrounding documentation does not warn that the example performs a local file write, which is a user-impacting operation covered by the missing-warning rule for markdown files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest limits the skill's purpose to locating, listing, and counting files/folders using Everything. This example shows search results being fed into an archival operation, implying downstream modification or handling of files that is outside the declared search-only scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains a scripting pattern that moves files to an archive directory, which affects user data and can change system state. The reference does not include any caution, confirmation guidance, or warning near the example to alert users that it will relocate matching files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.