ClawHub
Back to skill

Security audit

Lianke Print Box

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned for cloud printing and scanning, but it installs an unpinned third-party CLI from a mutable Git repository that will handle credentials and documents.

Install only if you trust the Lianke CLI repository and service. Treat the API key, device ID, and device key as secrets, and avoid printing or scanning sensitive documents unless you are comfortable with the cloud service, device, and network path handling that content. Prefer a pinned, reviewed CLI version before using this in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Third-Party CLI Installed from a Mutable Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` and `SKILL.md:26-29` **Vulnerability Type**: Unpinned executable dependency from an external Git repository **Risk Level**: Medium ### Vulnerable Code Metadata declaration at `SKILL.md:5`: ```yaml metadata: {"openclaw":{"emoji":"🖨️","requires":{"bins":["lk-print"]},"install":[{"id":"uv","kind":"uv","package":"git+https://github.com/liankenet/lk-print-box.git","bins":["lk-print"],"label":"Install lk-print (uv)"}]}} ``` Installation instructions at `SKILL.md:26-29`: ```bash # Global installation (registers lk-print in PATH) uv tool install git+https://github.com/liankenet/lk-print-box.git ``` ### Technical Analysis The Skill installs the `lk-print` executable directly from the mutable default revision of an external Git repository. The dependency is not constrained to a reviewed release, tag, commit hash, or integrity digest. Consequently, the code installed when the command is executed can differ from the code that existed when the Skill was audited. Package-controlled build and installation logic may execute locally during installation, while the installed CLI subsequently receives cloud-printing credentials and access to documents submitted for printing or scanning. The audited project contains only `SKILL.md`; the external CLI implementation is not included. Therefore, this finding does not establish that the current upstream package is malicious. It identifies a supply-chain trust weakness that would allow a compromised or unsafe future upstream revision to be installed without a corresponding change to this Skill. ### Attack Path 1. An attacker compromises the upstream GitHub repository, a maintainer account, or its release workflow. 2. The attacker modifies the repository's default branch or package installation logic with malicious code. 3. A user or Agent follows the Skill metadata or documented setup command: `uv tool install git+https://github.com/liankenet/lk-print-box.gi ...[truncated 1215 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit rather than the repository's mutable default branch, for example: ```bash uv tool install "git+https://github.com/liankenet/lk-print-box.git@<reviewed-full-commit-hash>" ``` 2. Prefer a signed, versioned release from a trusted package registry when one is available. 3. Verify release signatures, commit signatures, or published integrity hashes before installation. 4. Review the exact pinned CLI source, including its build configuration, credential storage, network destinations, file-upload behavior, and update mechanisms. 5. Update both the Skill metadata and setup instructions so they reference the same immutable version. 6. Run the CLI under a least-privileged account or sandbox with access limited to the documents and devices needed for the requested task. 7. Store API and device credentials using operating-system-backed secure storage, restrict their permissions, and provide a documented rotation and revocation process. 8. Establish a controlled dependency-update process in which each new upstream version is reviewed and repinned explicitly. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly guides users to send documents to a remote cloud printing/scanning service and external device, but it does not warn that document contents and metadata may leave the local environment and be accessible to the vendor service, device operators, or compromised endpoints. In a printing/scan workflow this is a real security concern because users may submit sensitive files under the assumption the operation is local or privacy-neutral.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup instructions require an API key, device ID, and device key, but provide no warning that these are sensitive secrets that can enable unauthorized access to the cloud print box and related operations if leaked via shell history, logs, screenshots, or shared terminals. Because these credentials authorize remote device interaction, disclosure could let an attacker query devices, submit jobs, or access scans depending on backend permissions.

Static analysis

No suspicious patterns detected.