ClawHub
Back to skill

Security audit

InkOS

Security checks for vulnerabilities and agentic risk

Overview

InkOS is coherent for story creation, but it should be reviewed before install because it pulls an unpinned external npm CLI that may handle your API key and writing files.

Install only if you are comfortable running the @actalk/inkos npm CLI with access to your manuscript project and configured API keys. Prefer a pinned, audited package version, use environment or Studio secret storage rather than literal keys, avoid untrusted custom base URLs, and review local persistence, daemon, and localhost Studio settings before using it on sensitive work.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned External npm Dependency Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: { "openclaw": { "emoji": "📖", "requires": { "bins": ["inkos", "node"], "env": ["OPENAI_API_KEY"] }, "primaryEnv": "OPENAI_API_KEY", "homepage": "https://github.com/Narcooo/inkos", "install": [{ "id": "npm", "kind": "node", "package": "@actalk/inkos", "label": "Install InkOS (npm)" }] } }

Technical Analysis

The installation declaration references @actalk/inkos without an exact version or package-integrity hash. The package manager can therefore resolve a future release whose contents differ from those available when this Skill was reviewed.

The repository contains only SKILL.md; it does not include the npm package source, a lockfile, an integrity record, or other artifacts that would allow the executable dependency to be verified as part of this audit. The statement at SKILL.md:814 that the npm package has no lifecycle installation hooks cannot be independently confirmed from the submitted project.

This does not establish that the current package is malicious. It creates a supply-chain weakness in which compromise of the publisher account, registry package, release process, or a later package version could introduce executable behavior after approval of the Skill descriptor.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another component capable of publishing a new @actalk/inkos version.
  2. The attacker publishes a modified release containing malicious runtime code or lifecycle behavior.
  3. A user installs the Skill after that release is published.
  4. Because no exact version or integrity hash is specified, npm resolves the attacker-controlled release.
  5. The package executes with the permissions of the installing or invoking user.
  6. The compromised proc ...[truncated 973 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @actalk/inkos to an exact, audited version rather than allowing resolution of the latest compatible release.
  2. Record and verify the npm package integrity hash during installation.
  3. Include a lockfile or equivalent immutable dependency manifest in the distributed artifact.
  4. Verify that npm package provenance, publisher identity, and source repository match the documented project.
  5. Audit the contents, transitive dependencies, and lifecycle scripts of the exact package release before approving it.
  6. Enforce installation with lifecycle scripts disabled where operationally possible, and separately verify that the required package does not depend on them.
  7. Run the CLI with least privilege and expose only the environment variables required for the current operation.
  8. Restrict outbound network access to explicitly approved model, image, and research-provider endpoints.
  9. Add automated dependency monitoring and require renewed review whenever the pinned package version or integrity value changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
state, atomic persistence, and artifact truth. Standard AgentSkills / OpenClaw `SKILL.md` packages provide medium-specific craft and static references, but they

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
state, atomic persistence, and artifact truth. Standard AgentSkills / OpenClaw `SKILL.md` packages provide medium-specific craft and static references, but they

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Configure your LLM provider (OpenAI, Anthropic, or any OpenAI-compatible API)

Prefer --api-key-env so the key never appears in shell history:

export OPENAI_API_KEY=sk-xxx inkos config set-global --provider openai --base-url https://api.openai.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

For compatible/proxy endpoints, use --provider custom and point ONLY to trusted endpoints:

inkos config set-global --provider custom --base-url https://your-trusted-proxy.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

text

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill documents a custom provider mode that forwards the user's API key to an arbitrary base URL. Even though it warns users to trust the endpoint, this creates a real credential and data-exfiltration hazard if an agent or user is induced to configure an attacker-controlled proxy, especially in an agent ecosystem where skills may influence provider choices.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

export OPENAI_API_KEY=sk-xxx inkos config set-global --provider openai --base-url https://api.openai.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

For compatible/proxy endpoints, use --provider custom and point ONLY to trusted endpoints:

inkos config set-global --provider custom --base-url https://your-trusted-proxy.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

text

### Multi-Model Routing (Optional)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
Long-form writing still uses the chapter pipeline internally:
- **Input governance**: Architect / Planner / Composer preserve author intent, current focus, outline sections, and relevant truth files instead of injecting everything blindly.
- **Writing**: Writer produces prose with length governance, craft rules, and context selected for the current task.
- **Settlement and review**: Observer / Reflector update runtime state; Auditor checks continuity and quality; Reviser handles critical issues. The default write cycle keeps automatic repair conservative and leaves unresolved issues visible for human or agent follow-up.

Truth files are persisted as schema-validated JSON (`story/state/*.json`) with markdown projections for human readability. SQLite temporal memory database (`story/memory.db`) enables relevance-based retrieval on Node 22+.
Persisted story memory is isolated to its project and book, excludes credentials and unrelated files, and is never reused across projects unless the user explicitly imports material. Users can inspect or delete the owning book/project through Studio or CLI.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Configure your LLM provider (OpenAI, Anthropic, or any OpenAI-compatible API)

Prefer --api-key-env so the key never appears in shell history:

export OPENAI_API_KEY=sk-xxx inkos config set-global --provider openai --base-url https://api.openai.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

For compatible/proxy endpoints, use --provider custom and point ONLY to trusted endpoints:

inkos config set-global --provider custom --base-url https://your-trusted-proxy.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 492)May include surrounding context.

md
- Let the Chat Agent inspect the available skill catalog and call `use_skill` when the current user intent needs that expertise. Do not emulate this with session-kind routing, keyword lists, or substring matching.
- Force a skill by including `@skill-id` in the user message when the user explicitly chooses one.
- Treat skills as standard expertise packets containing instructions and static references. Prompt packs and governed context recipes are separate InkOS systems.
- Skill folders may contain static references. Read them only when needed, and never auto-execute bundled scripts.
- Do not treat skills as permissions. File edits, book creation, chapter writing, image generation, and exports still require the normal InkOS tools and confirmation gates.

### Workflow 18.5: Book-Bound Reference Material

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 749)May include surrounding context.

md
| `inkos genre copy <id>` | Copy built-in genre to project | For customization |
| `inkos write rewrite <book> <ch>` | Rewrite a specific chapter | Deletes chapter and later, rewrites from that point |
| `inkos book update [book-id]` | Update book settings | `--chapter-words`, `--target-chapters`, `--status`, `--lang` |
| `inkos book delete <book-id>` | Delete book and all chapters | `--force` to skip confirmation |
| `inkos plan chapter [book-id]` | Generate chapter intent | Preview what next chapter will do before writing |
| `inkos compose chapter [book-id]` | Generate runtime artifacts | Context, rule-stack, trace for next chapter |
| `inkos consolidate [book-id]` | Consolidate chapter summaries | Reduces context for long books (volume-level summaries) |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file includes user-facing example commands and requests in Chinese, such as the inkos interact examples and rename examples, without explicitly stating that users can choose their preferred language in those specific interaction surfaces. Because SQP-3 covers language/locale policy violations, presenting one language as the default interaction mode can be a mild policy concern unless choice or opt-in is made clear at the point of use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.