Essential Skills Installer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:43 AM UTC
• Version: 1.2.0

Overview

This skill is an installer for other OpenClaw skills, but it can force-install multiple mutable third-party skills with limited provenance checks and some misleading scope documentation.

Review the exact skills before installing, especially memory, self-improvement, and Notion-related skills. Avoid running the script unless you are comfortable letting it replace existing installed skills, and prefer pinned, publisher-verified installs where available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: install.sh:11
• Finding: Unverified and Unpinned Third-Party Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:11-20, 59-69` **Vulnerability Type**: Supply-chain exposure through mutable, unverified dependencies **Risk Level**: High ### Vulnerable Code ```bash ESSENTIAL_SKILLS=( "skill-vetter" "tavily-search" "self-improving-agent" "memory-os" "find-skills" "skill-creator" "summarize" "notion" ) ``` ```bash for skill in "${ESSENTIAL_SKILLS[@]}"; do echo "📦 安装 $skill..." if skillhub install "$skill" --force 2>/dev/null; then echo " ✅ $skill 安装成功" ((SUCCESS++)) else echo " ❌ $skill 安装失败" ((FAILED++)) FAILED_LIST+=("$skill") fi done ``` ### Technical Analysis The installer retrieves and installs eight third-party skills using mutable package names. It does not pin package versions, verify checksums or signatures, validate the resolved publisher or source, or inspect the downloaded artifacts before installation. The `--force` option further increases risk because it may overwrite an existing trusted installation without preserving or comparing the installed version. Redirecting standard error to `/dev/null` also hides security-relevant package resolution and installation diagnostics. The project does not contain evidence that any listed package is currently malicious. The vulnerability is the unsafe trust model: the effective installed content is determined by external registry state at execution time and can differ from what was reviewed. ### Attack Path 1. An attacker compromises the package registry, a publisher account, or one of the named skill packages. 2. The attacker publishes a malicious release under an existing mutable skill name. 3. A user or agent executes `install.sh` and confirms installation. 4. The script invokes `skillhub install "$skill" --force`. 5. The external package is downloaded without version, signature, or checksum validation. 6. The malicious or compromised skill replaces any exist ...[truncated 1061 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every skill to an exact immutable version rather than installing by name alone. 2. Verify package signatures or cryptographic hashes against trusted, independently distributed values. 3. Validate the resolved registry, publisher identity, package source, and package metadata before installation. 4. Remove `--force` from the default installation path. Require explicit confirmation before replacing an existing installation. 5. Display the resolved version and publisher for each skill before requesting user approval. 6. Audit each downloaded skill before enabling or invoking it, particularly skills that handle memory, credentials, or self-modifying behavior. 7. Preserve installation errors instead of discarding standard error. If output must be controlled, write it to a protected audit log. 8. Use an allowlist containing approved package identities, versions, hashes, and trusted registry endpoints. 9. Run installation with the least-privileged account necessary and isolate installed skills where supported. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:63
• Finding: Shell Error Handling Causes Premature Termination During Counter Updates<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:3, 60-68` **Vulnerability Type**: Unsafe Bash arithmetic combined with immediate-exit behavior **Risk Level**: Medium ### Vulnerable Code ```bash set -e ``` ```bash for skill in "${ESSENTIAL_SKILLS[@]}"; do echo "📦 安装 $skill..." if skillhub install "$skill" --force 2>/dev/null; then echo " ✅ $skill 安装成功" ((SUCCESS++)) else echo " ❌ $skill 安装失败" ((FAILED++)) FAILED_LIST+=("$skill") fi done ``` ### Technical Analysis Bash arithmetic commands return a success status when the resulting expression is nonzero and a failure status when it evaluates to zero. A post-increment expression evaluates to the variable's value before incrementing. Both counters are initialized to zero. Therefore, the first execution of either `((SUCCESS++))` or `((FAILED++))` evaluates to zero and returns exit status 1. Because the script enables `set -e`, that nonzero status can terminate the installer immediately. This means the script may stop after the first attempted installation, regardless of whether that installation succeeds or fails. The remaining skills may not be processed, and the final result summary may not be shown. ### Attack Path 1. A user launches `install.sh` and confirms installation. 2. The first `skillhub install` command either succeeds or fails. 3. The corresponding zero-valued counter is updated using post-increment. 4. The arithmetic command returns exit status 1 because its pre-increment value was zero. 5. `set -e` causes the shell to terminate the script. 6. The environment is left with only a partial set of requested skills, and the completion summary is skipped. An external attacker is not required to trigger this issue. A malicious or unreliable package source could nevertheless exploit the predictable early termination to disrupt deployment or leave an inconsistent installation state. ### Impact Assessment The primary impact ...[truncated 698 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace post-increment expressions with forms that do not return failure on the initial update: ```bash ((++SUCCESS)) ((++FAILED)) ``` Alternatively, use assignments whose status is not derived from the arithmetic value: ```bash SUCCESS=$((SUCCESS + 1)) FAILED=$((FAILED + 1)) ``` Additional hardening should include: 1. Test the script under successful, failed, and mixed installation outcomes. 2. Use explicit error handling around each installation rather than relying broadly on `set -e`. 3. Add an `EXIT` trap or other mechanism that always prints a partial-installation summary. 4. Return a nonzero final status when one or more packages fail, while still attempting every package. 5. Add automated shell analysis and tests, such as ShellCheck and a test harness covering counter behavior. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad and generic enough to overlap with ordinary user requests such as installation or initialization. In a skill whose primary action is to run an installation script, broad triggering increases the chance of unintended activation that could cause unauthorized system changes or package installation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs running a shell script and says the AI will automatically execute it, but it does not present warnings about system modification, package provenance, permissions, or user consent. In the context of an installer skill, omitting these safeguards is dangerous because it normalizes silent execution of code that can alter the system and potentially install risky downstream skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example invocation '帮我安装必备技能' is highly generic and likely to match normal conversational requests. Because the skill is designed to invoke a shell installer, this broad activation pattern creates a realistic risk of accidental execution and unintended changes to the host environment.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: All user-facing strings in the script are in Chinese, including installation prompts, status messages, and configuration guidance. This imposes a specific language on users without offering opt-in, fallback, or documenting that the skill is intended only for a Chinese-speaking audience.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: L38 写明“全部安装 5 个必备技能”，但同一文档在 L22-L32 实际列出了 8 个将被“一键全部安装”的技能。这不是单纯信息缺失，而是安装范围说明彼此冲突，可能误导用户对脚本实际行为和安装规模的判断。

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: L50 明确表示“AI 会自动运行安装脚本”，这属于对实际执行行为的承诺；但本文件仅包含文档内容，没有任何可验证的自动执行实现。该表述会让用户误以为该技能本身具备直接触发脚本执行的代码能力，构成文档意图与可见实现之间的偏差。

Static analysis

No suspicious patterns detected.