Ms Todo

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:18 AM UTC
• Version: 0.1.1

Overview

This is a disclosed Microsoft To Do integration, but users should understand it can change or delete tasks and depends on an external MorphixAI plugin/API key.

Install only if you trust the MorphixAI/OpenClaw plugin source, are comfortable linking your Microsoft To Do account, and understand that the documented tool actions can create, update, complete, and delete tasks. Prefer reviewing task lists before modification and confirming destructive requests clearly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

1. **安装插件**: `openclaw plugins install openclaw-morphixai`

Technical Analysis

The documented installation command retrieves the openclaw-morphixai plugin without specifying an immutable version, cryptographic checksum, signature, lockfile, or authoritative source repository. The installed artifact can therefore change after this Skill has been reviewed.

The plugin implementation is not included in the project, so its behavior and requested permissions could not be audited. If the package publisher account, registry entry, or distribution infrastructure were compromised, the unpinned command could install a modified release containing attacker-controlled code.

Attack Path

1. An attacker compromises the plugin publisher account, package registry entry, or another part of the plugin distribution channel.
2. The attacker publishes a malicious version under the expected openclaw-morphixai package name.
3. A user follows the installation instruction in SKILL.md.
4. Because no version or artifact digest is specified, the installer resolves and downloads the current malicious release.
5. The plugin executes within the OpenClaw environment when loaded or invoked.
6. Subject to the plugin runtime's permissions, the malicious code may access environment variables, intercept tool data, or perform actions using linked services.

Impact Assessment

Successful exploitation requires compromise or malicious control of the external dependency distribution channel. The resulting privileges depend on OpenClaw's plugin isolation and operating-system permissions. Potentially exposed assets include the MORPHIXAI_API_KEY, Microsoft To Do task content available through the linked account, and other files, credentials, or network resou ...[truncated 271 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than resolving the latest available release.
2. Provide the plugin's authoritative registry and source repository references so users can verify publisher identity and inspect the implementation.
3. Publish and verify a cryptographic checksum or trusted digital signature for the expected plugin artifact.
4. Use a dependency lockfile or equivalent immutable dependency manifest where supported.
5. Configure the plugin manager to accept packages only from trusted registries and verified publishers.
6. Document the plugin's required permissions and run it with least privilege, restricting access to unrelated environment variables, files, and network services.
7. Review new plugin versions before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes destructive operations such as task deletion and completion but does not explicitly warn users that these actions modify or permanently remove task data. In an agent-driven context, this increases the chance of unintended data loss if a user request is ambiguous or the agent selects a destructive action without clear confirmation.

Content

No source excerpt is available for this finding.