Enrich Layer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:30 PM UTC
• Version: 0.2.0

Overview

The skill is coherent for contact enrichment, but it needs review because it runs an unpinned npm MCP server with an API key and exposes personal contact lookups without clear privacy guardrails.

Install only if you trust the npm package publisher and Enrich Layer account handling. Prefer pinning the MCP package to a reviewed exact version, limiting the process environment to only the Enrich Layer key, and using personal email or phone lookup only with proper authorization and applicable privacy-law compliance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md:29-30` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json "command": "npx", "args": ["-y", "@verticalint-michael/enrich-layer-mcp"], ``` ### Technical Analysis The MCP configuration invokes `npx` with the `-y` option and a package name that has no exact version constraint. Consequently, startup may automatically retrieve and execute whichever package release the registry currently resolves as the default version, without interactive confirmation or integrity verification. The effective executable can therefore change after the Skill has been reviewed. In addition, the package executes with the privileges of the OpenClaw process and is explicitly provided the `ENRICH_LAYER_API_KEY` environment variable. The personal npm scope shown here also differs from the `enrichlayer/mcp-server` GitHub organization referenced by the documentation, creating provenance ambiguity that should be resolved before trusting the package. ### Attack Path 1. An attacker compromises the npm publisher account, package, release process, or another relevant supply-chain component. 2. The attacker publishes a malicious package version that becomes the version resolved by the unpinned package reference. 3. A user starts OpenClaw with the documented MCP configuration. 4. `npx -y` retrieves the mutable package version and executes it without requesting confirmation. 5. Malicious package code runs under the OpenClaw user's account and receives the configured API key through its environment. 6. The code can misuse the API credential and access resources available to that operating-system account, subject to the host's sandboxing and permissions. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the user running OpenClaw. The compromised dependency can read the supplied `ENRIC ...[truncated 321 chars]
• Remediation: ## Remediation Suggestions - Pin the package to an audited exact version, for example `@verticalint-michael/enrich-layer-mcp@X.Y.Z`, rather than allowing mutable default-version resolution. - Verify that the npm scope and publisher are officially controlled by the project linked in the documentation. - Prefer a reviewed installation step backed by a lockfile and registry integrity metadata instead of downloading code automatically whenever the MCP server starts. - Disable automatic confirmation and require explicit review before package installation or upgrades. - Establish a controlled dependency-update process that includes source review, vulnerability scanning, provenance verification, and regression testing. - Run the MCP server with least privilege in a sandbox or container, restrict filesystem and network access, and expose only the API credential strictly required by the server. - Rotate the API key immediately if dependency compromise is suspected, and monitor the account for unauthorized requests or credit consumption.

T08 · Insecure Dependencies

Warning

• Location: README.md:82
• Finding: README Recommends Unpinned Automatic Third-Party Package Execution## Vulnerability Details **File Location**: `README.md:82-83` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json "command": "npx", "args": ["-y", "@verticalint-michael/enrich-layer-mcp"], ``` ### Technical Analysis The installation documentation directs users to execute an unversioned npm package through `npx -y`. The package version and effective code are not fixed by the reviewed repository, while `-y` suppresses interactive installation confirmation. Users following this configuration may therefore download and execute a future or compromised release that was not part of this audit. Because the same configuration passes `ENRICH_LAYER_API_KEY` to the resulting process, supply-chain compromise would place that credential directly within the malicious process's environment. ### Attack Path 1. A malicious or compromised release is published under the referenced npm package name. 2. A user copies the README configuration into OpenClaw. 3. OpenClaw invokes `npx -y` without an exact version. 4. npm resolves, downloads, and executes the attacker-controlled release. 5. The malicious process obtains the API key and operates with the permissions granted to the OpenClaw user. ### Impact Assessment Exploitation can result in arbitrary execution under the OpenClaw user's privileges, disclosure and misuse of the Enrich Layer API key, unauthorized API charges or credit consumption, and access to other local or environment-based resources available to the process. The affected scope includes every user who adopts the documented unpinned configuration.
• Remediation: ## Remediation Suggestions - Update the example to reference an audited, exact package version. - Document how users can verify npm publisher identity, package provenance, and integrity before installation. - Recommend installing dependencies under a lockfile rather than retrieving a mutable release at each startup. - Remove `-y` where feasible so installation and upgrades require explicit authorization. - Document a secure upgrade procedure and advise users to review release changes before changing the pinned version. - Recommend sandboxing the MCP server and limiting its access to secrets, files, and outbound network destinations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly exposes tools to retrieve personal email addresses and phone numbers, but the documentation provides no privacy, consent, or appropriate-use warning. In a contact-enrichment context, this omission increases the risk that users will collect or misuse sensitive personal data without understanding legal, ethical, or policy constraints.

Static analysis

No suspicious patterns detected.