Security audit

Skill Dependencies

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its stated purpose, but its installer can make persistent skill installs from ClawHub without pinning or verifying the versions it claims to resolve.

Treat this as a review-before-install skill. The read-only scan, tree, dependency, and conflict scripts are proportionate for inspecting local skills. Be cautious with skill-install.sh: review the dependency plan yourself, prefer manually pinned installs, and avoid relying on its version examples or auto-resolution as an integrity guarantee.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/skill-install.sh:79
Finding: Resolved Skill Versions Are Ignored During Third-Party Installation
Content: View full analysis
/dev/null && \ echo -e " ${GREEN}✅ $skill${NC}" || \ echo -e " ${YELLOW}⚠️ $skill (may need manual install)${NC}" elif command -v clawhub &> /dev/null; then clawhub install "$skill" 2>/dev/null && \ echo -e " ${GREEN}✅ $skill${NC}" || \ ``` ### Technical Analysis The installer obtains dependency names and version constraints from remote registry metadata and stores the resolved version in `TO_INSTALL`. However, the installation phase invokes: ```bash openclaw skill install "$skill" --yes clawhub install "$skill" ``` rather than installing an exact specification such as `"$skill@$version"`. Consequently, the versions displayed or collected during dependency resolution do not constrain the artifact ultimately selected by the package-management CLI. The c ...[truncated 2349 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: Unlike the other TP4 entries, this one identifies materially different behavior: installing skills from an external registry, querying a remote service, and invoking external package-management or CLI actions. If the skill presents itself mainly as dependency analysis but also performs network-backed installation and command execution without explicit permission declarations and safety warnings, users may trigger system modification and code supply-chain risk under false assumptions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
In a skill's `SKILL.md` frontmatter:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises multiple shell-based commands and filesystem scans but does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where a user or runtime may not clearly understand that the skill can execute shell commands and inspect system, user, and project directories, increasing the risk of unintended command execution or overbroad local enumeration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes installation from an external registry and automatic dependency resolution without warning users that this can download content and modify the local environment. That omission is dangerous because users may treat the skill as a read-only analysis utility while it can initiate supply-chain exposure and system changes through transitive installs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for tracking dependencies between installed OpenClaw skills, visualizing skill trees, detecting circular dependencies, and managing versioning. This script instead searches the external ClawHub marketplace via CLI commands, which is a discovery capability rather than dependency analysis or version-management logic.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: When no CLI is available, the script enumerates local skill directories and matches skill names against a query string, optionally printing descriptions. That behavior helps find skills by name, but it does not analyze dependencies, detect circular references, or manage versions as claimed in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.