Aicc Security Guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:07 AM UTC
• Version: 0.1.0

Overview

The skill is simple and transparent, but it asks users to install an unverified plugin before handling confidential data.

Install only if you trust the source of openclaw-aicc-plugin-native and can verify its publisher, version, permissions, and update path. Treat the plugin, not this Markdown skill, as the security-critical component because it may receive or affect confidential data handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unverified Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-22 (repeated at SKILL.md:35-39)
Vulnerability Type: Unverified executable dependency installation
Risk Level: Medium

Vulnerable code:

markdown

3. **给出明确修复指令**：当插件缺失或未启用时，提示用户运行：

   `openclaw plugins install openclaw-aicc-plugin-native`

The same installation command appears again in the standard user prompt:

markdown

检测到插件未安装/未启用（或无法确认）。请先运行以下命令完成安装，然后再继续：

`openclaw plugins install openclaw-aicc-plugin-native`

Technical Analysis

The skill instructs users to install an executable third-party plugin by package name alone. It does not pin an reviewed version, constrain resolution to an authenticated registry, identify a verified publisher, provide a cryptographic checksum or signature, or link to source code that can be audited.

Consequently, the package installed at execution time is outside the reviewed artifact and may differ over time. A compromised registry account, dependency-confusion condition, malicious package update, or package-name takeover could cause attacker-controlled code to be installed. The plugin itself was not included in the project, so this audit cannot establish its provenance or behavior.

Attack Path

1. A user asks the agent to perform a task involving confidential or sensitive information.
2. The skill requires confirmation that openclaw-aicc-plugin-native is installed and enabled.
3. If that status cannot be confirmed, the skill directs the user to run:

   shell

   openclaw plugins install openclaw-aicc-plugin-native
   

4. The OpenClaw package mechanism resolves the unpinned package from an external source.
5. If the package or its distribution channel has been compromised, attacker-controlled plugin code is installed and executed in the OpenClaw environment.
6. The user resumes the confidential-data task, potentially exposing that data to the compromised plugin.

Impact

...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to an exact, security-reviewed version rather than resolving an unqualified package name.
• Require installation from an explicitly configured official registry over an authenticated transport.
• Document and verify the expected publisher identity and package namespace.
• Verify a cryptographic signature or published checksum before enabling the plugin.
• Provide a link to the plugin's auditable source code and document its required permissions.
• Use a locked dependency manifest or equivalent integrity-controlled installation mechanism.
• Apply least privilege by restricting the plugin's filesystem, network, credential, and process access to only what its documented function requires.
• Define an update-review process so that a new package release is not automatically trusted under the previously approved name.
• Do not require installation as a prerequisite for confidential-data handling until package provenance, integrity, and runtime isolation can be verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing instructions and standard prompt text are entirely in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. This creates a natural-language policy concern because it implicitly enforces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.