openclaw-knowledge-coach

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:34 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward knowledge-import and practice-workflow guide, with visible risks around installing OpenPraxis and using an LLM provider rather than hidden or deceptive behavior.

Install only in a virtual environment or other isolated workspace, avoid running it with elevated privileges, review or pin the OpenPraxis package/source version, and remember that configured LLM providers may process imported document content depending on the provider you choose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Dependency Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-28 **Vulnerability Type**: Unpinned and unverified third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown **Install from PyPI (recommended):** ```bash pip install openpraxis praxis --help ``` Or install from source for development: ```bash git clone https://github.com/Sibo-Zhao/OpenPraxis.git cd OpenPraxis pip install -e ".[dev]" praxis --help ``` ``` ### Technical Analysis The skill directs users or agents to install and execute the `openpraxis` package without pinning a reviewed version, verifying package hashes, or validating the downloaded source. The alternative installation procedure clones the mutable default branch of a remote GitHub repository and installs it with development dependencies. Package installation can execute dependency-controlled build backends or installation hooks. Subsequent `praxis` commands execute the installed package with the permissions and environment of the invoking user. Consequently, the effective code executed by this skill may change after the skill itself has been reviewed. This creates a software supply-chain risk. Compromise of the PyPI project, GitHub repository, maintainer account, release process, or a transitive dependency could introduce attacker-controlled code into the documented workflow. ### Attack Path 1. An attacker compromises the `openpraxis` package, its repository, a maintainer account, or one of its unpinned transitive dependencies. 2. The attacker publishes a malicious package release or modifies the repository's default branch. 3. A user or agent follows the skill instructions and runs `pip install openpraxis` or clones and installs the current repository contents. 4. Attacker-controlled code executes during package build or installation, or when a subsequent `praxis` command is invoked. 5. The malicious code operates with the invoking user's permissions and can access resources availa ...[truncated 584 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `openpraxis` to a reviewed, immutable version rather than installing the latest available release. 2. Use a dependency lock file and require cryptographic hashes for the package and all transitive dependencies, such as with `pip --require-hashes`. 3. If installation from source is necessary, check out a reviewed commit hash rather than the mutable default branch. 4. Verify package provenance, release signatures, and repository ownership before installation. 5. Avoid installing development extras in production or routine user workflows. 6. Install the package in an isolated virtual environment or sandbox with access restricted to only the documents required for the task. 7. Do not install or run the package with administrative or root privileges. 8. Minimize the environment inherited by the process, especially API keys and unrelated credentials. 9. Perform dependency and source-code review whenever the pinned package version or commit is updated. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

- Use one-shot runtime model override only when requested:

```bash
praxis --provider openai --model gpt-4.1-mini add "/absolute/path/to/note.md"
```

- For image notes, pass image file path directly to `praxis add`; OCR extraction is built in.

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.