NORNR MCP Control

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:08 AM UTC
• Version: 0.1.6

Overview

This skill is a disclosed NORNR governance bridge, but users should review its pinned external SDK before using it for payment or approval workflows.

Install only after reviewing or trusting the pinned nornr-agentpay==0.1.0 SDK artifact. Use a dedicated NORNR API key with only the scopes needed, avoid optional finance/webhook scopes unless required, and test that non-approved NORNR states stop downstream actions before enabling autonomous workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Third-Party Runtime Dependency Lacks Artifact Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; nornr_governance.py:1-17
Vulnerability Type: Third-party supply-chain dependency without hash verification or locally auditable implementation
Risk Level: Medium

Complete Code Snippet

requirements.txt:1:

text

nornr-agentpay==0.1.0

nornr_governance.py:1-17:

python

import sys

try:
    from agentpay.openclaw import openclaw_cli
except ImportError as exc:  # pragma: no cover - install-time guard
    sys.stderr.write(
        "Missing dependency: agentpay\n"
        "Install the pinned NORNR SDK dependency first:\n"
        "  python -m pip install -r requirements.txt\n"
        "Pinned package release:\n"
        "  nornr-agentpay==0.1.0\n"
    )
    raise SystemExit(1) from exc


if __name__ == "__main__":
    raise SystemExit(openclaw_cli())

Technical Analysis

The project delegates all executable governance behavior to the external nornr-agentpay package. The requirement is version-pinned, which prevents ordinary upgrades to another version, but it does not use package hashes or include the dependency source in the audited artifact. Consequently, this audit cannot verify the dependency's import-time behavior, network destinations, credential handling, filesystem access, subprocess use, or implementation of approval decisions.

Python executes top-level package code during the following import:

python

from agentpay.openclaw import openclaw_cli

The imported function then receives control of the process through:

python

raise SystemExit(openclaw_cli())

Therefore, the security of the skill depends almost entirely on the integrity of the externally distributed package. Version pinning alone does not cryptographically ensure that the installed artifact is the exact artifact reviewed by an operator.

Attack Path

A feasible supply-chain exploitation path is:

1. An operator follows the documented installation command and runs `python -m pi ...[truncated 1815 chars]

Remediation

View remediation

Remediation Suggestions

1. Require cryptographic package hashes

   • Generate a lock file containing hashes for the exact approved wheel or source distribution.
   • Install with pip --require-hashes so an artifact that differs from the reviewed package is rejected.

2. Lock the complete dependency graph

   • Resolve and pin every transitive dependency rather than only the direct nornr-agentpay requirement.
   • Review dependency changes before updating the lock file.

3. Audit the delegated implementation

   • Review the source corresponding exactly to nornr-agentpay==0.1.0.
   • Verify import-time behavior, network endpoints, TLS validation, credential storage, subprocess execution, filesystem operations, and approval-state handling.
   • Preserve the reviewed source revision and artifact hashes as audit evidence.

4. Strengthen release provenance

   • Verify package ownership and the relationship between the documented source repository and the published PyPI artifact.
   • Prefer signed releases, attestations, and reproducible builds where available.
   • Use a controlled internal package mirror containing only approved artifacts.

5. Apply least privilege

   • Use a dedicated NORNR API key rather than a general operator credential.
   • Grant only the scopes required by the enabled commands.
   • Do not grant optional finance or webhook scopes unless those features are actually used.
   • Rotate the key if dependency integrity is ever uncertain.

6. Isolate runtime execution

   • Run the bridge under a dedicated, unprivileged operating-system account or sandbox.
   • Restrict filesystem access and outbound network destinations to those strictly required.
   • Avoid exposing unrelated credentials through the process environment.

7. Fail closed at the calling workflow

   • Ensure dependency errors, malformed responses, unavailable services, queued states, and blocked states cannot be interpreted as approval.
   • Require an ...[truncated 88 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.