AIP Security Guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 0.1.0

Overview

The skill is coherent as a security guard, but it asks users to globally install mutable third-party security tooling that is not included in the reviewed artifact.

Install only if you trust the `aip-openclaw` npm package and publisher. Prefer a pinned, reviewed version, avoid installing as an administrator, and understand that this tool can influence skill trust decisions, capability enforcement, and local audit or trust-list state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g aip-openclaw

Technical Analysis

The setup command installs the registry-selected latest version of aip-openclaw globally. It does not specify an exact version, verify an integrity hash, use a lockfile, or otherwise bind the installation to the artifact that was reviewed.

npm packages and their transitive dependencies may run lifecycle scripts during installation. Consequently, the effective code executed by this instruction can change whenever a package release or dependency changes. The package's implementation is not included in the audited project, so its advertised signature verification, access controls, trust-list operations, and audit logging cannot be validated from this artifact.

Global installation increases exposure by making the package available system-wide for the current environment and may grant installation-time access based on the invoking user's privileges.

Attack Path

1. An attacker compromises the package maintainer account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version containing harmful package code or an npm lifecycle script.
3. A user follows the documented setup command without an exact version constraint.
4. npm resolves the compromised release or dependency from the registry.
5. Malicious lifecycle code executes during installation under the invoking user's privileges.
6. The globally installed package may subsequently execute additional malicious behavior whenever users or agents invoke it.

Impact Assessment

Successful exploitation may permit arbitrary code execution with the privileges of the user running npm. Depending on those privileges and the host configuration, the compromised package cou ...[truncated 356 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, security-reviewed version rather than allowing npm to select the latest release.
2. Publish and verify an integrity digest or signed provenance for the approved package artifact.
3. Prefer a project-local installation with a committed lockfile instead of a global installation.
4. Audit the package and its complete transitive dependency tree before recommending installation.
5. Disable npm lifecycle scripts with --ignore-scripts when they are not required. If scripts are necessary, document and review each script before installation.
6. Document the expected registry and source repository, and verify that the package identity and publisher are authentic.
7. Run the package with least privilege in an isolated environment. Do not install it as root or an administrative user.
8. Add reproducible installation instructions that bind the package name, exact version, integrity value, and trusted registry.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.