说人话 NoJargon

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 0.2.0

Overview

This is a small discovery skill that points users to a plain-language OpenClaw plugin and does not itself contain hidden code or unsafe instructions.

Before installing, review the referenced plugin package and publisher because enabling it changes how replies are generated and rewritten. Use the documented `/nojargon status` and `/nojargon off` controls if you want to inspect or disable it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-28
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

text

- GitHub repository: `https://github.com/Sheygoodbai/nojargon`
- Plugin install: `openclaw plugins install clawhub:@sheygoodbai/openclaw-nojargon`
- Enable plugin: `openclaw plugins enable nojargon`

Technical Analysis

The skill instructs users or agents to install and enable a mutable third-party plugin without specifying an immutable version, commit, checksum, or cryptographic signature. The audited project contains only the discovery document and does not include the plugin implementation, so the behavior of the installed dependency cannot be verified from this artifact.

Because the installation command does not pin an audited release, it may retrieve a newer package than the one originally reviewed. Compromise of the package publisher, registry entry, distribution infrastructure, or a future release could introduce attacker-controlled behavior through this supply-chain boundary.

The document states that the plugin uses hooks to steer reply generation and rewrite outgoing text. These capabilities are consistent with its advertised purpose, but they also mean that a compromised release could affect generated or delivered content.

Attack Path

1. An attacker compromises the third-party package publisher, registry entry, release process, or distribution account.
2. The attacker publishes a malicious release under the referenced package identity.
3. A user or agent follows the unpinned installation command in SKILL.md.
4. OpenClaw resolves and installs the currently available package rather than a previously audited immutable release.
5. The user enables the plugin.
6. The malicious dependency executes through the plugin hooks available to it and can manipulate processing within the scope of those hooks.

Impact Assessment

Successful ex ...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a specific audited version or, preferably, an immutable source commit.
• Publish and verify a cryptographic checksum or trusted signature before installation.
• Configure the package source to reject unexpected publishers, package identities, or unsigned releases.
• Review the plugin source and release artifacts before enabling it.
• Document the plugin hooks, filesystem access, network access, credentials, and other permissions it requires.
• Apply least privilege so the plugin can access only the reply-processing functionality required for plain-language rewriting.
• Use a lockfile or equivalent reproducible dependency manifest where supported.
• Establish a controlled update process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title explicitly frames the skill as '说人话' and the metadata/description center the skill around a Chinese-language phrasing convention without indicating that users can choose their preferred language or locale. This can violate language/locale policy when a skill imposes a specific linguistic style by default rather than offering opt-in or choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.