T08 · Insecure Dependencies
Warning
- Location
scripts/add_daily_pm_cron.sh:30- Finding
Unpinned Package Execution in a Recurring Agent Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Repo Kanban PM
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its repo-management purpose, but its optional cron helper creates persistent agent automation and embeds a hardcoded unpinned npx command that should be reviewed before use.
Install only if you want this skill to change repo PM files and possibly add a recurring OpenClaw task. Review both scripts first, avoid the cron helper unless you understand which agent credentials it will use, remove or replace the hardcoded `apps/telegram && npx tsc --noEmit` check, and choose your own timezone, agent, and schedule.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly tells users to execute local shell scripts that modify repository state and may install a recurring cron job, but it does not clearly foreground that these actions change files and system scheduling. In a security-sensitive agent setting, hidden or underexplained side effects can lead users to run automation without reviewing what will be changed, increasing the risk of persistence, unwanted task execution, or policy violations if the scripts are altered or unsafe.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This script creates a persistent scheduled job immediately via
openclaw cron addwith no confirmation, dry-run, or explicit opt-in beyond invoking the script. In the context of a repo-management skill, that means a user or agent can unintentionally install ongoing automation that repeatedly inspects repository state and posts reports, creating lasting side effects and possible privacy or operational issues.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation's example uses
--tz Europe/Minsk, which imposes a locale-specific setting in the natural-language usage guidance. The file does not explicitly frame timezone selection as user-configurable guidance or prompt the user to choose their own locale, so it can be read as forcing a specific locale by default.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script defaults to
Europe/Minsk, which imposes a specific locale-related setting unless the user notices and overrides it. This can violate language/locale policy expectations because the locale choice is preselected rather than explicitly opted into.- Content
Static analysis
No suspicious patterns detected.