skill-usage

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:13 PM UTC
• Version: 1.0.3

Overview

The skill openly sets up usage analytics, but it can install an unpinned external plugin and restart the gateway from requests that may only be asking to view usage data.

Review the plugin package and publisher before installing, prefer a pinned or verified release, and only invoke this setup skill when you intentionally want to install or enable the plugin and accept a gateway restart. Use local-only mode unless you explicitly want shared/cloud analytics, because channel labels, routing identifiers, installation labels, timestamps, status, and latency may still be sensitive metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:161

Finding

Unpinned External npm Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 161-170
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install openclaw-skill-usage

If the user is working from a local cloned repo instead of npm, a development install may use:

bash

openclaw plugins install --link

But prefer the published npm package for normal setup.

Technical Analysis

The Skill instructs the agent to install openclaw-skill-usage from the npm registry without specifying a reviewed version, integrity digest, immutable commit, or signed release. Consequently, the package resolved at installation time may differ from the version that existed when this Skill was reviewed.

The dependency's implementation is not included in the audited project, which contains only SKILL.md. Its installation hooks and runtime behavior therefore cannot be verified through this audit. If the npm package, publisher account, or release process is compromised, a malicious future release could execute during installation or when loaded by the OpenClaw Gateway.

The local --link alternative also requires trust in the contents and provenance of the cloned repository, although the instructions appropriately limit that method primarily to development use.

Attack Path

1. An attacker compromises the npm publisher account, package release pipeline, or another component of the package's supply chain.
2. The attacker publishes a malicious release under the existing openclaw-skill-usage package name.
3. A user asks the agent to install skill-usage analytics.
4. Following SKILL.md, the agent runs the unversioned installation command.
5. The package manager resolves and installs the attacker-controlled release.
6. Malicious package installation hooks or plugin runtime code execute in the OpenClaw environment.
7. The subsequent gateway restart loads ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version rather than resolving the latest available release.
2. Verify the package against a trusted integrity digest or lockfile before installation.
3. Prefer an immutable, signed release artifact or a repository commit identified by its full commit hash.
4. Document the expected npm publisher, package provenance, and signature-verification procedure.
5. Audit package contents, installation scripts, transitive dependencies, and runtime permissions before approving a new version.
6. Disable or reject unexpected lifecycle scripts where the package manager and installation workflow permit it.
7. Run the plugin and Gateway under a least-privileged account with access limited to the data and resources necessary for usage analytics.
8. For linked development installations, verify the cloned repository's remote, commit hash, and working-tree contents before running openclaw plugins install --link.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrase list includes "show which skills are used most," which can match a routine analytics/query request rather than an explicit installation or setup intent. Because this skill performs privileged actions like external package installation and gateway restart, overly broad invocation criteria can cause the agent to take invasive setup actions when the user only wanted information or read-only usage results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.