ClawHub
Back to skill

Security audit

Daily Standup

Security checks for vulnerabilities and agentic risk

Overview

The skill’s daily standup purpose is coherent, but it should be reviewed because broad trigger phrases can cause it to summarize sensitive data from many connected work accounts through an unpinned external plugin.

Install only if you trust the MorphixAI plugin and are comfortable connecting the listed work accounts. Use the narrowest account scopes available, avoid connecting email or calendar unless needed, and ask for confirmation or specify sources before running broad daily-summary requests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
1. **安装插件**: `openclaw plugins install openclaw-morphixai`

Technical Analysis

The Skill instructs users to install the third-party openclaw-morphixai plugin without specifying an immutable version, package digest, trusted repository, or signature-verification procedure. Consequently, the dependency retrieved during installation may differ from the version originally reviewed.

The plugin's implementation is not included in the audited project, so its behavior and integrity cannot be verified from this repository. This is a supply-chain risk rather than proof that the named plugin is currently malicious.

Attack Path

  1. An attacker compromises the plugin's publishing account, package registry entry, distribution channel, or upstream build process.
  2. The attacker publishes a modified release under the same mutable package name.
  3. A user follows the instruction at SKILL.md:14.
  4. The installer retrieves and executes or activates the compromised plugin.
  5. The plugin accesses data and credentials available through its runtime permissions, including the MorphixAI API key and connected integrations.

Impact Assessment

A compromised plugin could act with the permissions granted to the OpenClaw process and connected MorphixAI accounts. Depending on configured scopes, exposed resources may include GitLab or GitHub repositories and work items, Jira issues, Outlook or Gmail messages, task lists, and calendar events. Potential consequences include sensitive-data disclosure, credential theft, unauthorized API operations, and compromise of the local agent environment.

The precise privilege and data scope depend on the plugin runtime, host permissions, API-key capabilities, and account authorization scopes.

Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to a specifically reviewed version or, preferably, an immutable package digest.
  • Document the plugin's official registry namespace and source repository to reduce dependency-confusion and typosquatting risk.
  • Verify package signatures or checksums before installation.
  • Maintain an allowlist of approved plugin publishers and versions.
  • Review the plugin source and release artifacts before approving upgrades.
  • Grant the API key and connected accounts only the scopes required to generate the report.
  • Separate especially sensitive integrations, such as email and source control, into independently revocable credentials.
  • Monitor dependency advisories and require explicit review before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to link multiple external accounts and then aggregates data from code hosting, issue trackers, mail, tasks, and calendars, but it does not clearly warn that sensitive organizational and personal data will be accessed and summarized. This weakens informed consent and increases the risk of users exposing confidential project status, unread email subjects, and meeting details through an apparently routine “daily standup” request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad and overlap with ordinary requests like “standup”, “日报”, or “帮我看看今天有什么”, which can cause the skill to activate when the user did not explicitly intend cross-service aggregation. In this skill, activation leads to querying multiple linked work accounts, so accidental invocation can expose sensitive summaries from GitLab, Jira, email, tasks, and calendars without sufficiently specific user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction ‘严格按以下结构回复（中文，精简）’ mandates Chinese responses for all users. This is a natural-language locale constraint, and the file does not provide user opt-in, language selection, or a documented reason that the skill must be Chinese-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.