OpenClaw Skill Growth

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:54 AM UTC
• Version: 0.1.1

Overview

This wrapper is coherent, but installing it means cloning and running mutable external npm code that is not packaged or pinned in the reviewed artifact.

Treat this as a review-needed install. Before using it on real skills, pin the GitHub repository to a reviewed commit or release tag, inspect package scripts and dependencies, prefer npm ci with a lockfile when available, run dry-run first, and only grant it access to skill directories you are prepared to change or restore from backup.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:57

Finding

Unpinned Retrieval and Execution of External Code and Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-61; duplicated in INSTALL.md:6-20
Vulnerability Type: Remote mutable code retrieval and insecure dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:57-61:

bash

git clone https://github.com/Shuai-DaiDai/openclaw-skill-growth.git
cd openclaw-skill-growth
npm install
npm run build
npm run test

INSTALL.md:6-20:

bash

git clone https://github.com/Shuai-DaiDai/openclaw-skill-growth.git
cd openclaw-skill-growth

bash

npm install

bash

npm run build
npm run test

Technical Analysis

The audited package is a documentation-only wrapper and does not contain the plugin implementation, a package manifest, a dependency lockfile, or executable scripts. Instead, it instructs users to clone the default state of an external Git repository and execute installation and npm scripts.

The clone operation is not pinned to a reviewed commit hash or immutable, verified release artifact. Consequently, the code executed by users may differ from the code that existed when this wrapper was reviewed. In addition, npm install can retrieve mutable third-party packages and execute npm lifecycle scripts with the privileges of the installing user.

No malicious upstream code or dependency was demonstrated in the available artifact. The vulnerability is the unsafe trust and execution model: the effective payload is external, mutable, and not verifiable from this package.

Attack Path

1. An attacker compromises the referenced upstream repository, its default branch, a maintainer account, or a transitive npm dependency.
2. The attacker introduces malicious code into a build, test, lifecycle, or other npm script.
3. A user follows the documented installation instructions and clones the current default branch without verifying a commit or release signature.
4. The user runs npm install, which may exec ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the upstream source to a reviewed full commit hash rather than cloning and executing the mutable default branch.
2. Prefer an immutable release archive and publish its SHA-256 checksum or cryptographic signature. Require users to verify it before execution.
3. Include a committed dependency lockfile in the upstream project and instruct users to run npm ci rather than unconstrained npm install.
4. Review and document all npm lifecycle scripts. Where compatible with the project, install dependencies using npm ci --ignore-scripts, then explicitly run only reviewed scripts.
5. Pin automated installation references to immutable dependency versions and use dependency integrity verification.
6. Document that build, test, and apply commands execute external code and should run in an isolated, least-privilege environment without unnecessary secrets.
7. Package the reviewed implementation with the skill where feasible, or include sufficient manifests and source material to permit the effective payload and dependency graph to be audited.
8. Require explicit review and backups before any apply workflow is granted write access to real skill directories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.