ClawHub
Back to skill

Security audit

Enrich Layer

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for contact enrichment, but it needs review because it runs an unpinned npm MCP server with an API key and exposes personal contact lookups without clear privacy guardrails.

Install only if you trust the npm package publisher and Enrich Layer account handling. Prefer pinning the MCP package to a reviewed exact version, limiting the process environment to only the Enrich Layer key, and using personal email or phone lookup only with proper authorization and applicable privacy-law compliance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-30
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json
"command": "npx",
"args": ["-y", "@verticalint-michael/enrich-layer-mcp"],

Technical Analysis

The MCP configuration invokes npx with the -y option and a package name that has no exact version constraint. Consequently, startup may automatically retrieve and execute whichever package release the registry currently resolves as the default version, without interactive confirmation or integrity verification.

The effective executable can therefore change after the Skill has been reviewed. In addition, the package executes with the privileges of the OpenClaw process and is explicitly provided the ENRICH_LAYER_API_KEY environment variable. The personal npm scope shown here also differs from the enrichlayer/mcp-server GitHub organization referenced by the documentation, creating provenance ambiguity that should be resolved before trusting the package.

Attack Path

  1. An attacker compromises the npm publisher account, package, release process, or another relevant supply-chain component.
  2. The attacker publishes a malicious package version that becomes the version resolved by the unpinned package reference.
  3. A user starts OpenClaw with the documented MCP configuration.
  4. npx -y retrieves the mutable package version and executes it without requesting confirmation.
  5. Malicious package code runs under the OpenClaw user's account and receives the configured API key through its environment.
  6. The code can misuse the API credential and access resources available to that operating-system account, subject to the host's sandboxing and permissions.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user running OpenClaw. The compromised dependency can read the supplied `ENRIC ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to an audited exact version, for example @verticalint-michael/enrich-layer-mcp@X.Y.Z, rather than allowing mutable default-version resolution.
  • Verify that the npm scope and publisher are officially controlled by the project linked in the documentation.
  • Prefer a reviewed installation step backed by a lockfile and registry integrity metadata instead of downloading code automatically whenever the MCP server starts.
  • Disable automatic confirmation and require explicit review before package installation or upgrades.
  • Establish a controlled dependency-update process that includes source review, vulnerability scanning, provenance verification, and regression testing.
  • Run the MCP server with least privilege in a sandbox or container, restrict filesystem and network access, and expose only the API credential strictly required by the server.
  • Rotate the API key immediately if dependency compromise is suspected, and monitor the account for unauthorized requests or credit consumption.

T08 · Insecure Dependencies

Warning
Location
README.md:82
Finding

README Recommends Unpinned Automatic Third-Party Package Execution

Content
View full analysis

Vulnerability Details

File Location: README.md:82-83
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json
"command": "npx",
"args": ["-y", "@verticalint-michael/enrich-layer-mcp"],

Technical Analysis

The installation documentation directs users to execute an unversioned npm package through npx -y. The package version and effective code are not fixed by the reviewed repository, while -y suppresses interactive installation confirmation. Users following this configuration may therefore download and execute a future or compromised release that was not part of this audit.

Because the same configuration passes ENRICH_LAYER_API_KEY to the resulting process, supply-chain compromise would place that credential directly within the malicious process's environment.

Attack Path

  1. A malicious or compromised release is published under the referenced npm package name.
  2. A user copies the README configuration into OpenClaw.
  3. OpenClaw invokes npx -y without an exact version.
  4. npm resolves, downloads, and executes the attacker-controlled release.
  5. The malicious process obtains the API key and operates with the permissions granted to the OpenClaw user.

Impact Assessment

Exploitation can result in arbitrary execution under the OpenClaw user's privileges, disclosure and misuse of the Enrich Layer API key, unauthorized API charges or credit consumption, and access to other local or environment-based resources available to the process. The affected scope includes every user who adopts the documented unpinned configuration.

Remediation
View remediation

Remediation Suggestions

  • Update the example to reference an audited, exact package version.
  • Document how users can verify npm publisher identity, package provenance, and integrity before installation.
  • Recommend installing dependencies under a lockfile rather than retrieving a mutable release at each startup.
  • Remove -y where feasible so installation and upgrades require explicit authorization.
  • Document a secure upgrade procedure and advise users to review release changes before changing the pinned version.
  • Recommend sandboxing the MCP server and limiting its access to secrets, files, and outbound network destinations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly exposes tools to retrieve personal email addresses and phone numbers, but the documentation provides no privacy, consent, or appropriate-use warning. In a contact-enrichment context, this omission increases the risk that users will collect or misuse sensitive personal data without understanding legal, ethical, or policy constraints.

Content

No source excerpt is available for this finding.