Intercom Support Channel

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:38 AM UTC
• Version: 1.0.2

Overview

This skill is a clear setup guide for an Intercom support bot, with sensitive customer-facing permissions disclosed and mostly scoped to the stated purpose.

Before installing, review the referenced plugin source and package version, use a dedicated Intercom app with only the permissions you need, pilot on one low-risk channel, monitor early conversations, and keep the token easy to revoke or rotate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42
• Finding: Unverifiable External Plugin Dependency Installed from a Third-Party Registry## Vulnerability Details **File Location**: `SKILL.md`, lines 42-49 **Vulnerability Type**: Supply-chain risk from an externally retrieved executable dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. Install the plugin — **pin the version** so you get exactly the release you reviewed (this skill and the plugin share the same publisher, and the package is source-linked on ClawHub, so every version maps to a verifiable GitHub commit): ```bash openclaw plugins install clawhub:@othreecodes/openclaw-intercom@1.0.12 ``` Check ClawHub for the latest version and its changelog before upgrading; treat plugin ``` ### Technical Analysis The Skill directs users to install and execute `@othreecodes/openclaw-intercom` from the external ClawHub registry. The audited project contains only `SKILL.md`; it does not contain the plugin source code, an expected cryptographic digest, a trusted signature, or other material that independently verifies the downloaded artifact. Pinning the dependency to version `1.0.12` limits unintentional version drift, but a version pin alone does not guarantee artifact integrity. The effective executable behavior remains dependent on the security of the publisher account, package registry, package-to-source mapping, and distribution infrastructure. The documentation's assertion that releases map to GitHub commits cannot be independently validated from the supplied artifact. This is classified as `T08: Insecure Dependencies` rather than remote payload retrieval because the external component is installed through a package registry as a declared third-party dependency. No evidence in the audited file establishes that the package is malicious; the finding concerns the absence of locally verifiable integrity controls and the fact that the executable implementation was outside the audit scope. ### Attack Path 1. An attacker compromises the package publisher account, registry entry, release process, or a ...[truncated 1517 chars]
• Remediation: ## Remediation Suggestions 1. Include or vendor the exact reviewed plugin source in the audited release so its executable behavior can be assessed together with the Skill. 2. Publish and verify a cryptographic digest for the `1.0.12` package artifact before installation. 3. Require signed releases and verify the package signature against a trusted, independently distributed publisher key. 4. Document the exact immutable source commit corresponding to version `1.0.12`, and verify that the distributed package is reproducibly built from that commit. 5. Lock package resolution to the intended registry and publisher namespace to reduce dependency-confusion and registry-substitution risks. 6. Review the plugin source and transitive dependencies independently before production deployment. 7. Continue using a dedicated Intercom application with the minimum required permissions, restricted channels, and a readily revocable token. 8. Test the plugin in an isolated staging environment before connecting it to a production inbox. 9. Monitor package ownership, release-signing status, unexpected artifact changes, credential use, and customer-facing actions. 10. Rotate Intercom credentials immediately if package integrity or publisher security becomes uncertain.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

teammate identity — confirm with whoever owns the support workspace before enabling it.

3. In the Intercom Developer Hub, create a **dedicated app** for the bot (don't reuse a
   broader app's token), copy its **Access token**, and grant only what you'll use:
   read/write conversations, plus read contacts and read/write tags if you want those
   features. Keep the token rotatable — you'll want revocation to be one click if
   anything looks wrong.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. **Get authorization first.** This agent will reply to real customers under a real
   teammate identity — confirm with whoever owns the support workspace before enabling it.

3. In the Intercom Developer Hub, create a **dedicated app** for the bot (don't reuse a
   broader app's token), copy its **Access token**, and grant only what you'll use:
   read/write conversations, plus read contacts and read/write tags if you want those
   features. Keep the token rotatable — you'll want revocation to be one click if

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.