SimpliXio Loop

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This is a text-only planning skill with standard OpenClaw installation instructions and no evidence of hidden execution, data theft, or destructive behavior.

Installing the skill is reasonable if you want a broad planning and prioritization helper. Be aware that it may be invoked for general planning work, and avoid following the optional publishing instructions with a global unpinned npm install unless you trust and verify the CLI version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: PUBLISH.md:19
• Finding: Unpinned Global npm Dependency Installation## Vulnerability Details **File Location**: `PUBLISH.md`, lines 19–23 **Vulnerability Type**: Supply-chain risk from an unpinned third-party dependency **Risk Level**: Medium **Vulnerable Code**: ```markdown Install the ClawHub CLI if needed: ```bash npm i -g clawhub ``` ``` ### Technical Analysis The publishing instructions install the latest version of the `clawhub` npm package globally. No version, lockfile, package integrity value, provenance requirement, or lifecycle-script restriction is specified. Because the package version is mutable, the code executed by this command may differ from what maintainers previously reviewed. npm packages can execute lifecycle scripts during installation, and the subsequently invoked CLI can execute package-controlled logic. The global installation scope also places the executable in a shared user or system tool location rather than isolating it to this project. The project does not vendor the dependency or provide package metadata that would allow its contents and transitive dependencies to be audited as part of this review. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency, or causes an unsafe future version to be published. 2. A project maintainer follows `PUBLISH.md` and runs `npm i -g clawhub`. 3. npm resolves the mutable latest package version and downloads its dependency tree. 4. Malicious package lifecycle code may execute during installation with the maintainer's current privileges. 5. The globally installed `clawhub` executable may subsequently execute attacker-controlled behavior during login or publication. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running npm. Potential effects include access to files and credentials available to that account, theft of publishing credentials, tampering with artifacts, and replacement or modification of ...[truncated 235 chars]
• Remediation: ## Remediation Suggestions - Pin the CLI to a specifically reviewed version rather than resolving the latest release. - Prefer a project-local development dependency governed by a committed lockfile instead of a global installation. - Invoke the pinned local executable through the package manager while preventing unexpected version resolution. - Verify npm registry provenance, publisher identity, package integrity, and release signatures where available. - Audit the selected package version and its transitive dependencies before use. - Disable lifecycle scripts during installation unless the reviewed package explicitly requires them. - Run publishing tools in a minimally privileged, isolated environment with narrowly scoped and short-lived credentials. - Document the validated package version and a controlled process for reviewing upgrades.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

## Install

```bash
mkdir -p ~/.openclaw/skills
cp -R simplixio-decision-loop ~/.openclaw/skills/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The README provides example invocations such as 'Use the SimpliXio Decision Loop to decide what I should do next' and named modes, but it does not clarify whether these are the only supported triggers, preferred exact phrases, or merely illustrative examples. Without scope constraints or exclusion examples, the activation conditions are underspecified and could lead to unintended invocation overlap with generic planning requests.

Static analysis

No suspicious patterns detected.