Openclaw Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about connecting to production monitoring and remediation tools, but it asks users to install and authorize a high-impact MCP integration that can change live deployments and code.

Review this before installing if the token can access production systems. Prefer a pinned, reviewed @inariwatch/mcp version, use the least-privileged InariWatch token available, and require explicit human confirmation before remediation, rollback, reindexing, or any action that changes deployments, code, or alert state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Package Execution During Setup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx @inariwatch/mcp init

Technical Analysis

The recommended setup command invokes @inariwatch/mcp through npx without specifying an exact package version or integrity constraint. Consequently, the package resolved from the registry when the command is run may differ from the version reviewed during this audit.

npx downloads and executes package code locally. If the package, its dependency chain, its publisher account, or the package registry is compromised, a modified release could execute arbitrary commands under the invoking user's account. This is an insecure supply-chain practice even though no malicious behavior is present in the audited file itself.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the relevant registry distribution path.
2. The attacker publishes a malicious version that satisfies the unversioned package request.
3. A user follows the documented setup procedure and runs npx @inariwatch/mcp init.
4. npx retrieves the attacker-controlled version and executes its CLI or lifecycle code locally.
5. The payload operates with the invoking user's privileges and may access files, environment variables, credentials, and agent configuration available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the setup command. The accessible scope may include the user's local files, environment variables, OpenClaw configuration, stored credentials, and INARIWATCH_TOKEN if it is present in the process environment or readable configuration. Any further privilege gain would depend on the invoking account's existing permissions; the audited material does not establish administrat ...[truncated 22 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the command to a reviewed, immutable package version, for example:

  bash

  npx --yes @inariwatch/mcp@X.Y.Z init
  

• Document the expected package publisher, registry, release version, and integrity digest.

• Verify package provenance and signatures where supported by the distribution platform.

• Audit direct and transitive dependencies before updating the pinned version.

• Use a lockfile and integrity-checked installation workflow where practical.

• Consider installing the reviewed package in a restricted environment before execution.

• Avoid exposing unrelated secrets to the setup process and apply least-privilege filesystem and environment access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill exposes many broad natural-language invocation examples such as 'What's breaking in production?' and 'Roll back production' without clear activation boundaries beyond generic phrasing. In an agent environment, this increases the chance of accidental tool activation or misrouting from ordinary user requests, which is especially risky here because some tools can change live infrastructure or code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to run npx @inariwatch/mcp init without pinning a specific package version. Because npx fetches the latest published package at execution time, a compromised publisher account, malicious update, or dependency-chain attack could cause arbitrary code to run on the user's machine during setup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.