ClawHub
Back to skill

Security audit

Openclaw Skill Minimax Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local MiniMax usage counter with disclosed local storage and no evidence of hidden credential access, exfiltration, or destructive behavior.

Before installing from GitHub, prefer a reviewed release, commit hash, or checksum-verified copy. Expect the skill to create or update ~/.openclaw/workspace/minimax_usage_data.json when you run the add command, and only configure the reminder schedule if you want periodic status checks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:31
Finding

Unpinned Installation from a Mutable Git Repository

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 31-36
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
# Clone to your OpenClaw workspace
cd ~/openclaw-workspace/skills
git clone https://github.com/QiaoTuCodes/openclaw-skill-minimax-tracker.git

# Or copy manually
cp -r openclaw-skill-minimax-tracker ~/openclaw-workspace/skills/

Technical Analysis

The documented installation procedure clones the default branch of a repository controlled through a personal GitHub account. It does not pin the installation to an audited commit, signed tag, or checksum-verified release.

Consequently, the files installed by following these instructions may differ from the files covered by this audit. The effective payload remains mutable: the repository owner, a compromised maintainer account, or an attacker who gains repository access could replace minimax_tracker.py or add other executable Skill content after review.

The flagged badge and release links at README.md:12-14 do not themselves download or execute an executable. They are external links and images. The relevant supply-chain exposure is the unpinned git clone instruction followed by execution of repository code.

Attack Path

  1. An attacker compromises the upstream GitHub account or obtains write access to the repository.
  2. The attacker modifies the default branch and inserts malicious code into minimax_tracker.py or another Skill file.
  3. A user follows the documented git clone installation procedure, receiving the modified branch rather than the audited artifact.
  4. The user or OpenClaw agent invokes the altered tracker through the documented status, add, or compact commands.
  5. The injected code executes with the permissions and environment of that user or agent.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user o ...[truncated 475 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin installation instructions to a specific reviewed commit hash rather than the mutable default branch.
  • Alternatively, distribute a versioned release archive and publish its SHA-256 checksum.
  • Use signed Git tags or release attestations and document signature verification before installation.
  • Instruct users to inspect or verify downloaded content before invoking any Skill script.
  • Configure the repository with protected branches, mandatory review, strong maintainer authentication, and restricted release permissions.
  • Prefer a trusted package or Skill distribution channel that provides immutable versions and provenance verification.

T08 · Insecure Dependencies

Warning
Location
README-CN.md:30
Finding

Unpinned Installation from a Mutable Git Repository in Chinese Documentation

Content
View full analysis

Vulnerability Details

File Location: README-CN.md, lines 30-35
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
# Clone to your OpenClaw workspace
cd ~/openclaw-workspace/skills
git clone https://github.com/QiaoTuCodes/openclaw-skill-minimax-tracker.git

# Or manually copy
cp -r openclaw-skill-minimax-tracker ~/openclaw-workspace/skills/

Technical Analysis

This installation procedure also retrieves the current default branch from a repository controlled through a personal GitHub account. No reviewed commit, signed release, immutable version, or integrity checksum is specified.

The content obtained by a future user can therefore differ from the artifact examined during this audit. An upstream repository or maintainer-account compromise could turn this installation channel into a supply-chain delivery mechanism for modified executable code.

The release link and remote badge image at README-CN.md:12 do not directly execute or download a program. The security issue arises from cloning mutable repository content and subsequently running its Python script.

Attack Path

  1. An attacker compromises the upstream repository, its owner account, or another authorized maintainer.
  2. Malicious code is committed or force-pushed to the repository’s default branch.
  3. A user follows the unpinned clone command in README-CN.md.
  4. The altered repository is installed into the OpenClaw Skills directory.
  5. The user, an integrated agent, or a configured reminder invokes the modified tracker.
  6. The malicious code executes in the invoking account’s security context.

Impact Assessment

Exploitation may provide arbitrary code execution under the user or OpenClaw agent account. Accessible workspace data, local files, environment variables, agent credentials, and permitted network services could be exposed or modified.

No use of sudo, operating-sy ...[truncated 177 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the default-branch clone instruction with installation of a specific audited commit or immutable release.
  • Publish cryptographic checksums for release artifacts and require checksum verification.
  • Sign release tags or artifacts and provide explicit signature-verification commands.
  • Keep installation guidance consistent across all language versions so users receive the same integrity protections.
  • Enforce repository branch protection, reviewed changes, strong maintainer authentication, and restricted release access.
  • Recommend execution with only the filesystem and network permissions required for local usage tracking.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.