Security audit

Cuchd Login

Security checks for vulnerabilities and agentic risk

Overview

This skill asks the agent to handle login credentials and authenticated browser actions, but its package identity and login destination do not line up and its autonomy is too broad.

Do not install this without verifying the publisher and the correct official login domain. If this is legitimate, it should be republished with consistent package metadata, a verified origin allowlist, and explicit confirmations before entering credentials, submitting forms, downloading files, or making account changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:48
Finding: Credential Submission Is Redirected to a Domain Inconsistent with the Package Identity
Content: View full analysis
" into the password field > ⚠️ **Security rule**: Never log, store, echo, or write the password anywhere. --- ### Step 5 — Submit Login browser: click the Login button ``` ### Technical Analysis The package metadata presents the project as a login automation helper for `staff.cuchd.in`, but the skill instructions direct the agent to navigate to `openclaw.in` and submit the user's username and password there. This unexplained hostname mismatch creates a credential-substitution attack. A user selecting the package based on its name and description could reasonably believe that credentials are being supplied to the declared CUCHD staff portal. The loaded instructions instead control the browser destination and cause the credentials to be entered into a different origin. The instruction not to log or echo the password does not mitigate disclosure to the website receiving the submitted login form. The sensitive operation is transmission of the password to the inconsistent endpoint itself. No project documentation establishes that `openclaw.in` is an authorized authentication provider for `staff.cuchd.in`, and the inspected package contains no mechanism for validating the destination origin before credentials are entered. ### Attack Path 1. A user ins ...[truncated 1335 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Skill Instructions Suppress User Confirmation and Self-Grant Unrestricted Browser Authority
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is configured to trigger on vague mentions like 'OpenClaw' or 'claw dashboard' without requiring a clear user action request. In combination with full browser autonomy, this can cause the agent to initiate sensitive portal access or state-changing actions from ambiguous prompts, increasing the risk of unintended navigation, data exposure, or account actions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The instruction to proceed 'without asking for confirmation at each step' enables autonomous decision-making during access to an authenticated business portal. In this context, reduced human oversight materially increases the chance of unintended data access, form submission, navigation to sensitive areas, or unsafe handling of unexpected UI flows.
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
even if the user only mentions "OpenClaw", "claw portal", or asks to "open the claw dashboard". This skill grants the agent full permission to operate the browser autonomously — including clicking, typing, waiting, reading page content, and navigating — without asking for confirmation at each step. version: 1.0.0 permissions: browser: full

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly permits autonomous form submission and file downloads but does not require user acknowledgement of side effects such as modifying records, submitting applications, or saving files locally. This is dangerous because a mistaken interpretation or prompt injection on the target site could lead to unintended changes or downloads without a human checkpoint.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 1)May include surrounding context.
json
{ "name": "cuchd-login", "version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 2)May include surrounding context.
json
{ "name": "cuchd-login", "version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).", "main": "index.js",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 3)May include surrounding context.
json
{ "name": "cuchd-login", "version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).", "main": "index.js", "keywords": [

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 5)May include surrounding context.
json
"name": "cuchd-login", "version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).", "main": "index.js", "keywords": [ "openclaw", "skill",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 6)May include surrounding context.
json
"version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).", "main": "index.js", "keywords": [ "openclaw", "skill", "cuchd",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 7)May include surrounding context.
json
"version": "0.1.0", "description": "OpenClaw skill to assist with staff.cuchd.in login actions (automation helper).", "main": "index.js", "keywords": [ "openclaw", "skill", "cuchd",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 8)May include surrounding context.
json
"main": "index.js", "keywords": [ "openclaw", "skill", "cuchd", "login" ],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 9)May include surrounding context.
json
"main": "index.js", "keywords": [ "openclaw", "skill", "cuchd", "login" ],

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"openclaw", "skill", "cuchd", "login" ], "author": "Your Name you@example.com", "license": "MIT",

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"skill", "cuchd", "login" ], "author": "Your Name you@example.com", "license": "MIT", "engines": {

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 13)May include surrounding context.
json
"login" ], "author": "Your Name you@example.com", "license": "MIT", "engines": { "node": ">=14" }

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 14)May include surrounding context.
json
], "author": "Your Name you@example.com", "license": "MIT", "engines": { "node": ">=14" } }

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 15)May include surrounding context.
json
"author": "Your Name you@example.com", "license": "MIT", "engines": { "node": ">=14" } }

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · package.json (reported line 16)May include surrounding context.
json
"license": "MIT", "engines": { "node": ">=14" } }