Security audit

Global Citizen: 全球身份规划

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed immigration-planning research skill made of markdown instructions, with no executable payload or hidden persistence found.

Before installing, prefer a versioned or reviewed release instead of blindly running the unpinned npx or cloning the default branch. Treat the skill as advisory only: verify immigration, tax, and fee information with official government sources and qualified professionals before making decisions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:84
Finding: Unpinned Third-Party Installation Sources
Content: View full analysis
Remediation: View remediation
install global-mobility@ ``` 2. Pin manual installation to an immutable commit or signed release rather than the repository's default branch: ```bash git clone https://github.com/PandaBro666/global-mobility.git cd global-mobility git checkout ``` 3. Publish SHA-256 checksums or cryptographic signatures for release archives and require users to verify them before installation. 4. Prefer downloading a versioned release archive over cloning a mutable branch. 5. Document a review-before-copy process so users can inspect all Skill instructions and scripts before placing them in `~/.openclaw/skills/`. 6. Where supported, disable npm lifecycle scripts during acquisition and separate package download from execution. 7. Protect upstream publisher accounts with multi-factor authentication, signed commits or tags, restricted release permissions, and automated supply-chain scanning. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger examples are broad and cover common terms like immigration, passports, visas, and tax residency without clear scope boundaries. In agent environments, that can cause unintended auto-invocation on adjacent topics, pulling in skill instructions and external-search behavior when the user did not explicitly request this workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx clawhub install global-mobility without pinning a specific package version. That exposes installers to supply-chain risk if the upstream package changes, is compromised, or resolves differently over time, causing execution of unreviewed code on the user's machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance frames residence requirements and flexibility in terms of compatibility with a "China-based life" and maintaining identity while living in China. This imposes a specific locale/user-context assumption in natural-language guidance without indicating that it is optional or only for China-based users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file begins with a Chinese-only title and all substantive guidance is written exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README explicitly states the skill starts '以大陆华人视角出发' (from a Mainland Chinese perspective), which imposes a locale/cultural framing in the skill's natural-language behavior. There is no accompanying opt-in, alternative audience selection, or justification that the skill is only intended for that region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file uses only Chinese throughout, which can amount to a language/locale policy issue if the organization expects skills not to force a single language without user opt-in. There is no visible statement that the content is region- or language-specific, nor any alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L080 includes the Chinese term "焦虑" embedded in otherwise English documentation. This introduces a language/locale inconsistency without user opt-in or any explanation that the skill is intentionally multilingual or region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.