Security audit

Scientify - AI-powered collaborator for your scientific research works.

Security checks for vulnerabilities and agentic risk

Overview

This installer skill is mostly transparent about installing a research automation plugin, but it explicitly tells the agent to install without asking and uses an unpinned external package.

Review this before installing. Only proceed if you intentionally want to add the Scientify plugin, and prefer an install flow that shows the resolved package version, publisher, and integrity information and asks for confirmation. Treat the plugin as capable of downloading research materials, managing local research workspaces, generating and running code, and deleting projects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:24
Finding: Plugin Installation Is Directed to Proceed Without User Authorization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:66
Finding: Scientify Plugin Is Installed Without Version or Integrity Pinning
Content: View full analysis
**Note:** Do NOT use `npm install scientify`. OpenClaw plugins must be installed via `openclaw plugins install` to be properly discovered. ``` The associated metadata also identifies only an unversioned package name: ```yaml "install": [ { "id": "scientify", "kind": "node", "package": "scientify", "label": "Install Scientify plugin (npm)", }, ], ``` ### Technical Analysis The skill identifies the dependency only as `scientify` and invokes installation without a fixed version, immutable artifact reference, or integrity digest. Consequently, installation resolves whatever release the package source considers current at execution time. The `openclaw plugins install` wrapper may provide plugin discovery behavior, but the reviewed file contains no evidence that it pins or independently verifies an approved artifact. The effective code installed can therefore change after this skill has been reviewed. This creates supply-chain exposure if the package publisher account or registry is compromised, package ownership changes, a future release becomes malicious, or package resolution returns an unintended artifact. ### Attack Path 1. An attacker compromises the upstream package publisher, registry entry, or release process, or publishes a malicious future version under the same package identity. 2. The unversioned package reference resolves to the attacker-controlled release. 3. A user or agent runs `openclaw plugins install scientify`, potentially through the documented automatic installation path. 4. OpenClaw downloads and installs the newly resolved artifact. 5. Packag ...[truncated 812 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction 'Don't ask permission. Just do it.' explicitly encourages automatic installation without user confirmation. In the context of a plugin that adds code-generation, download, and experiment-execution capabilities, silent installation materially increases the chance of unauthorized package installation and expansion of the system's attack surface.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as an installer/setup helper, but its body advertises and normalizes broad autonomous research, code generation, downloading, and experiment-running capabilities. This scope mismatch can mislead users and higher-level policy/routing systems into invoking a much more powerful package than expected, increasing the risk of unreviewed code execution and overprivileged plugin installation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The metadata declares installation via a Node/npm package, while the markdown tells the user not to use npm and to use a different installation path. Conflicting installation instructions can cause users or orchestration systems to install via the wrong trust path, bypass expected validation, or create ambiguity about what artifact is actually being installed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.