ClawHub
Back to skill

Security audit

Openclaw Skill Langchain Local

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local Ollama/LangChain wrapper, with some documentation and dependency hygiene cautions but no evidence of hidden persistence, exfiltration, or unsafe automatic execution.

Install this only in a virtual environment you control, avoid running pip with elevated privileges, and treat the offline/privacy claim as dependent on your local Ollama configuration. Review or pin dependency versions if reproducibility or supply-chain control matters.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 9
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- Python packages: `pip install langchain langchain-ollama langchain-community`

The same unsafe installation pattern also appears in README.md, line 21:

markdown
- Python 3.9+: pip install langchain langchain-ollama langchain-community

Technical Analysis

The installation instructions retrieve the latest versions of three packages and their transitive dependencies without version constraints, cryptographic hashes, or a committed lockfile. Consequently, the installed code can change over time without any corresponding change to the audited project.

This creates a software supply-chain exposure. If a named package, one of its transitive dependencies, its package-publishing account, or the configured package index is compromised, users following the documented command could install attacker-controlled code. Python packages may execute code during installation or later when imported by main.py.

The audit did not identify evidence that the currently named packages are malicious. The finding concerns the project's unsafe and non-reproducible dependency installation process.

Attack Path

  1. An attacker compromises a package release, maintainer account, transitive dependency, or package index used by pip.
  2. The attacker publishes a malicious version that still satisfies the unrestricted dependency request.
  3. A user follows the project documentation and runs the unpinned pip install command.
  4. Pip resolves and installs the attacker-controlled release.
  5. Malicious code executes during installation or when the dependency is imported and used by main.py.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the skill. This may permit access ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  1. Define reviewed, exact dependency versions in a requirements or project metadata file.
  2. Generate and commit a reproducible lockfile that includes all transitive dependencies.
  3. Require cryptographic hashes for downloaded distributions, such as with pip's --require-hashes workflow.
  4. Update the documentation to install from the locked dependency set rather than directly installing unconstrained package names.
  5. Use an authenticated, trusted package index or an internally controlled package mirror.
  6. Automate dependency vulnerability and integrity scanning while reviewing upgrades before updating the lockfile.
  7. Perform installation in an isolated virtual environment under a non-privileged account, and explicitly warn users not to run pip with sudo.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · main.py (reported line 21)May include surrounding context.

python
("system", SYSTEM_PROMPTS[mode]),
        ("human", "{query}")
    ])
    return prompt | llm


def ask(query: str, mode: str = "coding") -> str:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation asserts 'No API keys, no cloud, fully private and offline' at L04, but the implementation section and requirements show dependence on an externally running Ollama service at L07 and execution of a Python program at L24. While still local, this contradicts the stronger implication of a self-contained offline skill and overstates what the skill itself guarantees.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- `rag` — Document-grounded answers (context-aware)

## Usage Examples
- "Ask langchain-local to write a Django REST API view"
- "Use langchain-local in devops mode to show how to check disk usage"
- "Run langchain-local chat mode: explain what is RAG"
- "Use langchain-local coding mode to write a PostgreSQL backup script"

Static analysis

No suspicious patterns detected.