Github Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:49 AM UTC
• Version: 0.1.1

Overview

This GitHub integration skill is coherent, but it enables repository-changing and workflow-triggering actions without clear guardrails.

Install only if you trust the MorphixAI plugin and understand what GitHub scopes are granted. Before using mutating actions, verify the target repository, branch, workflow file, environment, and whether the action could publish changes, close issues, consume CI resources, or deploy code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

text

1. **安装插件**: `openclaw plugins install openclaw-morphixai`

Technical Analysis

The installation command references the openclaw-morphixai plugin without pinning a reviewed version, immutable checksum, or signed artifact. As a result, the component installed by users can change after this skill has been reviewed.

Because the plugin mediates access to the MorphixAI service and a linked GitHub account, compromise of its publisher account, package repository, or release process could cause users to install attacker-controlled code. The audit found no evidence that the current plugin is malicious; the finding concerns the mutable and unverifiable dependency installation process documented by the skill.

Attack Path

1. An attacker compromises the plugin publisher, package repository, or distribution channel.
2. The attacker publishes a modified release under the expected openclaw-morphixai package name.
3. A user follows the prerequisite command in SKILL.md.
4. The package manager resolves the unversioned name to the attacker-controlled release.
5. The malicious plugin executes with the permissions of the OpenClaw process.
6. Depending on available credentials and granted scopes, it may access the MorphixAI API key or misuse the linked GitHub authorization.

Impact Assessment

Successful exploitation could allow arbitrary behavior within the security context of the OpenClaw process. Potential impact includes exposure of locally available credentials, unauthorized operations against linked GitHub repositories, modification of issues or pull requests, and triggering of GitHub Actions workflows. The exact repository scope and privileges depend on the permissions granted to the linked GitHub integration and the host environment.

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than resolving an unversioned latest release.
2. Prefer an immutable artifact identified by a cryptographic digest.
3. Verify package signatures or checksums before installation and fail closed if verification fails.
4. Document the approved package registry, publisher identity, and expected artifact hash.
5. Establish a controlled dependency-update process that includes security review before changing the pinned version.
6. Grant the linked GitHub integration only the repository access and API scopes strictly required for intended operations.
7. Keep production deployment permissions and sensitive GitHub Actions environments subject to independent approval controls.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents state-changing GitHub operations such as creating issues, updating issues, creating pull requests, and triggering GitHub Actions workflows, but it does not prominently warn that these actions can modify repositories or start CI/CD executions. In an agent context, missing safety guidance increases the chance of unintended writes, workflow runs, or operational side effects, especially because triggering workflows can consume resources or deploy code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language description and instructions force a specific language presentation for all users of the skill. Under the language/locale policy, this is a violation unless the skill offers user choice or clearly documents a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.