Supplychainsentinel

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:53 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for supply-chain automation, but it needs review because it can automatically create purchase orders, update ERP records, and send notifications using broad business credentials.

Install only if you intend to let the agent interact with live logistics, database, notification, and ERP systems. Use least-privilege credentials, default to monitoring or dry-run mode, disable automatic PO creation until explicitly approved, require confirmation for spending or customer-facing messages, and store supplier credentials in a secret manager rather than directly in the supplier table.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:7
• Finding: Overprivileged Access to Unrelated Service Credentials## Vulnerability Details **File Location**: `SKILL.md:7` **Vulnerability Type**: Excessive credential scope and violation of least privilege **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"env":["SHIPPO_API_KEY","FLEXPORT_API_KEY","OPENWEATHER_API_KEY","SLACK_WEBHOOK_URL","SENDGRID_API_KEY","DATABASE_URL"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"⚓"}} ``` ### Technical Analysis The skill declares simultaneous access to shipping-provider credentials, a weather-service credential, an outbound Slack webhook, a SendGrid credential, and the database connection string. It also requests `curl`, which can initiate arbitrary HTTP requests. These privileges are broader than necessary for many declared operations. For example, checking a weather forecast does not require database, Shippo, Flexport, Slack, and SendGrid access. Likewise, generating a local supplier report does not inherently require both outbound notification channels. Combining data-access credentials with outbound communication credentials creates a sensitive privilege chain: the same agent context may retrieve confidential shipment or supplier information and transmit it externally. Although Slack and email notifications are declared features, granting all credentials to every invocation exceeds task-specific least privilege. This file contains documentation rather than executable implementation, so the audit found no direct proof that credentials are currently exfiltrated. The vulnerability arises when the hosting platform exposes every declared environment variable to the skill or its agent context. ### Attack Path 1. A user invokes the skill for a narrow task, such as checking weather conditions. 2. The runtime exposes every environment variable listed in `requires.env`, including `DATABASE_URL`, shipping API keys, and outbound messaging credentials. 3. Malicious prompt content, c ...[truncated 1081 chars]
• Remediation: ## Remediation Suggestions 1. Split the skill into task-specific components, such as weather monitoring, shipment retrieval, database reporting, and stakeholder notification. 2. Inject only the credentials required for the currently authorized operation. 3. Do not make outbound-notification credentials available during read-only monitoring or reporting tasks. 4. Replace general-purpose `curl` access with domain-restricted API tools where the runtime supports them. 5. Apply least-privilege scopes to Shippo, Flexport, SendGrid, and database accounts. 6. Require explicit user confirmation before transmitting supplier, shipment, purchase-order, customer, or financial information. 7. Restrict outbound destinations to approved API hosts and notification recipients. 8. Redact credentials and sensitive fields from tool output, prompts, logs, and error messages. 9. Record auditable logs of credential use and outbound transmissions without recording secret values. 10. Rotate the affected credentials if they have already been exposed to an untrusted agent context.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:215
• Finding: Supplier API Credentials Stored in a General-Purpose Database Field## Vulnerability Details **File Location**: `SKILL.md:215-224`, with the vulnerable field at line 220 **Vulnerability Type**: Insecure storage of sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```sql CREATE TABLE suppliers ( supplier_id UUID PRIMARY KEY, name VARCHAR(255), api_type VARCHAR(50), api_credentials JSONB, backup_suppliers UUID[], on_time_rate DECIMAL, last_updated TIMESTAMP ); ``` ### Technical Analysis The recommended schema stores supplier API credentials directly in a general-purpose `JSONB` column. The design does not require secret-manager references, application-level encryption, restrictive column access, key rotation, or protection from database exports and backups. Database-level encryption at rest alone would not adequately mitigate this issue because users or applications with normal query access could still retrieve plaintext values. JSON credentials may also be unintentionally copied into diagnostic output, database dumps, analytics replicas, logs, or administrative tools. The surrounding setup instructions mention that credentials may be configured in a secrets manager, but the supplied schema explicitly encourages direct credential storage and does not enforce the safer approach. ### Attack Path 1. Supplier API secrets are inserted directly into `suppliers.api_credentials`. 2. An attacker compromises a database account, application account, backup, read replica, or administrative export with access to the `suppliers` table. 3. The attacker executes a query such as `SELECT api_credentials FROM suppliers`. 4. Retrieved tokens are replayed against the corresponding supplier or logistics APIs. 5. The attacker obtains whatever read or write capabilities were assigned to those tokens and retains access until they expire or are revoked. ### Impact Assessment A successful exploit could expose credentials for multiple suppliers from a single database ...[truncated 595 chars]
• Remediation: ## Remediation Suggestions 1. Remove `api_credentials JSONB` from the recommended schema. 2. Store only an opaque secret identifier, such as `credential_secret_ref`, that points to AWS Secrets Manager, HashiCorp Vault, or an equivalent service. 3. Configure the application identity to retrieve only the secret associated with the supplier currently being processed. 4. If database storage is unavoidable, use authenticated field-level encryption with keys maintained outside the database. 5. Restrict credential-column access through dedicated roles, views, and row-level security. 6. Ensure database backups, replicas, exports, and monitoring systems receive equivalent protection. 7. Prevent secret values from appearing in SQL logs, application logs, exceptions, audit events, and agent output. 8. Use short-lived, narrowly scoped tokens and implement automated rotation and revocation. 9. Audit all secret retrieval and supplier API use. 10. Migrate any existing plaintext credentials to a secret manager and rotate them after migration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion

Content

DATABASE_URL"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"⚓"}}

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill metadata description is broad enough to match general supply-chain and logistics requests, while the body advertises side-effecting capabilities such as automatic PO rerouting, ERP updates, Slack alerts, and email notifications. Over-broad invocation increases the chance the agent activates this skill in contexts where the user wanted analysis or planning only, causing unintended operational actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The overview markets automatic rerouting and stakeholder notifications up front but does not immediately warn that the skill can create purchase orders and update ERP records. This can mislead an orchestrating agent or user into treating the skill as observational, when it actually has write-side effects on business systems and outbound communications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This example instructs the system to automatically create alternative POs and notify teams based on weather thresholds, without requiring explicit approval at the point of action. In a real environment, false positives, bad data, or ambiguous user intent could lead to unauthorized purchasing, duplicate orders, or disruptive supplier/ERP changes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Next Steps:
1. Review backup PO in NetSuite: [Link]
2. Confirm customer notification preference
3. Approve cost variance (auto-approved if <15%)

Questions? Contact [e-mail]
```

• Confidence: 88% confidence
• Finding: The email example states that cost variance is auto-approved if below 15%, which normalizes autonomous approval of financially meaningful procurement actions. Even with a threshold, this can permit unintended purchases or rerouting based on inaccurate upstream API data, manipulated thresholds, or activation in the wrong context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- New suppliers require manual setup and API testing before activation
- Prevents accidental orders to unapproved or fraudulent suppliers

❌ **Will NOT send customer notifications without approval**
- Optional feature disabled by default
- Requires explicit opt-in per customer
- Uses templated, reviewed messaging only

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.