Lianke Print Box

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:09 PM UTC
• Version: 0.1.1

Overview

This skill does what it says, but it installs a mutable third-party executable that will handle printer credentials and documents.

Review this before installing. Use it only with Lianke devices you control, avoid sensitive documents unless authorized, protect the API and device credentials as secrets, and prefer a pinned or verified `lk-print` release instead of the mutable Git install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Executable Dependency Installed from a Mutable Git Branch## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 30–31 **Vulnerability Type**: Unpinned third-party Git dependency **Risk Level**: Medium The skill metadata and setup instructions install the `lk-print` executable directly from a Git repository without specifying an immutable commit, signed release, version constraint, or integrity digest. **Vulnerable code at line 4:** ```yaml metadata: {"openclaw":{"emoji":"🖨️","primaryEnv":"ApiKey","requires":{"bins":["lk-print"]},"install":[{"id":"uv","kind":"uv","package":"git+https://github.com/liankenet/ai-lk-print-box.git","bins":["lk-print"],"label":"Install lk-print (uv)"}]}} ``` **Vulnerable code at lines 30–31:** ```bash # Global installation (registers lk-print in PATH) uv tool install git+https://github.com/liankenet/ai-lk-print-box.git ``` ### Technical Analysis A Git URL with no commit hash or immutable release reference resolves to the repository's mutable default branch. Consequently, the code installed by users can differ from the code that was originally reviewed. Because `uv tool install` installs an executable into the user's environment, package build hooks or runtime code can execute with that user's privileges. The CLI is subsequently entrusted with an API key, device identifier, device key, local documents submitted for printing, scan results, and remote printer/scanner controls. A compromised upstream repository or malicious update could therefore replace legitimate CLI behavior with attacker-controlled logic. No evidence demonstrates that the current upstream package is malicious. The vulnerability is the absence of dependency immutability and integrity verification, which creates a supply-chain attack opportunity. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the mutable default branch. 2. The attacker adds malicious package installation or CLI runtime code. 3. A user or agent follows ...[truncated 1138 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit: ```bash uv tool install "git+https://github.com/liankenet/ai-lk-print-box.git@<reviewed-commit-sha>" ``` 2. Prefer a versioned, signed release from a trusted package registry rather than installing from a mutable Git branch. 3. Record and verify the expected artifact hash or lockfile integrity metadata before installation. 4. Enable signed commits or release signatures and verify them as part of the installation process. 5. Review dependency updates before changing the pinned revision, and use automated dependency and provenance scanning. 6. Run the CLI with least privilege and restrict its access to only the documents required for each operation. 7. Supply credentials through a protected secret mechanism, avoid exposing them in process arguments or logs, and rotate them if upstream compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This skill explicitly performs remote printing and scanning through a cloud-connected service, but the documentation does not clearly warn users that submitted files and scanned documents are transmitted to external infrastructure and a remote device. That omission can cause users to send sensitive documents without understanding the privacy and data-handling implications, especially in enterprise or regulated contexts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions require API and device credentials but do not include an explicit warning to protect them as secrets or guidance on secure storage and handling. Users may paste credentials into shared shells, logs, screenshots, or commit them into environment files, which could allow unauthorized parties to control the cloud print device, submit jobs, or access scan-related operations.

Static analysis

No suspicious patterns detected.