T08 · Insecure Dependencies
Warning
- Location
SKILL.md:30- Finding
Unpinned Global Installation of an Unauditable Third-Party CLI
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Reporter
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly transparent about opt-in telemetry, but it relies on an unpinned global third-party CLI that is not included for review.
Review this before installing because participation requires trusting the external npm package and https://kymr.top/ service. Prefer a pinned, reviewed CLI version or source-linked release, and only consent if you are comfortable sending platform, model, task-completion signals, optional token counts, and exposing your IP address to the service.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (7)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md 4. **Task reports are manual only** — only send when the user explicitly mentions completing a task or asks to report 5. If any OpenClaw request fails, continue normally — never interrupt the user's workflow 6. Never include identifying information in task summaries 7. **No system-level modifications**: never write to `~/.claude/settings.json` or any file outside `~/.openclaw/` ## CLI Reference
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The earlier description says task reports are sent only when the user explicitly mentions completing a task, but the later token-reporting section permits additional telemetry at session end. Even though token reporting is described as optional, it expands outbound data flows beyond the initial promise and can mislead users about when reporting may occur.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Model | `claude-sonnet-4-6` | Model usage stats | | Task summary | `"Completed a task"` | Generic activity indicator | **Stored locally:** Registration returns an `apiKey` from the server, saved in `~/.openclaw/config.json` with `chmod 600` (owner-only access). The endpoint URL (`https://kymr.top/`) is hardcoded — not read from the config file — so a modified config cannot redirect telemetry. **Visible to the server:** Your IP address is visible on every HTTPS request (inherent to any network call). The server uses IP for approximate geolocation on the heatmap — no more precise than city-level.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger condition for sending task reports—when the user 'explicitly mentions completing a task, finishing work, or asks to report activity'—is broad and subjective. Ambiguous wording can cause over-reporting of user activity and unnecessary network exfiltration based on loose interpretation rather than clear authorization.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 4. **Task reports are manual only** — only send when the user explicitly mentions completing a task or asks to report 5. If any OpenClaw request fails, continue normally — never interrupt the user's workflow 6. Never include identifying information in task summaries 7. **No system-level modifications**: never write to `~/.claude/settings.json` or any file outside `~/.openclaw/` ## CLI Reference
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s top-level description claims reporting is limited to heartbeat and explicit task reports, but later adds token-usage reporting and stats functionality. This creates a transparency and consent mismatch: users and auditors may approve the skill under narrower data-sharing assumptions than what the full document permits.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 2. If yes, report using the token command with your estimated usage 3. If no, continue normally **Note:** Token reporting is always optional and requires user consent. Never report tokens without asking.
Static analysis
No suspicious patterns detected.