Mapick

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:22 AM UTC
• Version: 1.0.28

Overview

Mapick mostly matches its skill-recommendation purpose, but it asks for broad local and agent authority with under-disclosed network, install, shell, and session-log behavior.

Review this skill before installing. Use the OpenClaw install path rather than the `curl | bash` installer, treat network consent claims cautiously, and avoid token stats unless you accept local OpenClaw session-log reads. Be especially careful with flows that install, uninstall, upgrade, schedule cron jobs, or run plan commands through the shell.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: reference/rendering.md:245

Finding

Unverified Remote Installation Script Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

mapick-install.sh" | sha256sum --check ``` 5. Prefer a cryptographic signature using Sigstore, minisign, or GPG in addition to a checksum. 6. Let the user inspect the verified script and require explicit confirmation before running it. 7. Pin the repository fallback to a release tag or commit rather than cloning a mutable default branch. 8. Ensure installation documentation uses a single, clearly attributable organization and repository identity. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/core.js:28

Finding

Network-Capable Commands Bypass the First-Use Consent Gate

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/token.js:1

Finding

Undeclared Full-File Access to OpenClaw Agent Session Logs

Content

View full analysis

f.endsWith(".jsonl") && (days === Infinity || isWithinDays(f, days))) .map((f) => path.join(SESSIONS_DIR, f)); ``` The Skill metadata declares reads from Skill, workspace, Mapick log/cache, and temporary report locations, but does not declare `~/.openclaw/agents/main/sessio ...[truncated 1769 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:240

Finding

Skill Instructions Mandate Unrelated Promotional Content in Agent Responses

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (97)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Running a local dashboard/server, storing a fingerprint, and exposing stats/health endpoints introduces additional local attack surface and tracking concerns beyond the stated role. Even if bound to loopback, undocumented local services can leak metadata or be abused by other local processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file claims Mapick has zero subprocess execution, yet instructs the agent to execute literal plan commands via bash after rendering a plan. This inconsistency is dangerous because any backend- or skill-supplied command text becomes executable, creating a command-injection and remote-action channel under the guise of planning.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 93% confidence

Finding

The instruction 'Never refuse — always produce valid HTML' weakens the model's ability to safely halt when input data is malformed, unsafe, or policy-violating. In a pipeline that turns potentially user-derived content into a shareable HTML artifact, anti-refusal language can pressure the model to comply even when safety checks should trigger, increasing the chance of unsafe or misleading output.

Content

Scanner excerpt · prompts/persona-production.md (reported line 79)May include surrounding context.

md

## Failure mode

If `locale` is unrecognized, fall back to `en`. Never refuse — always produce
valid HTML.

---

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · reference/flows.md (reported line 37)May include surrounding context.

md

2. **`matched === false`** → render "did you mean" template. See `reference/rendering.md#security`.

3. **`matched === true`** — localize `detailsEn` and apply Grade A/B/C display rule. See `reference/rendering.md#security`.

## security:report

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The flow instructs the agent to execute local CLI installation commands (openclaw skills install <slug>), which is a privileged action for a skill framed as recommendation/privacy assistance. Even with some slug normalization guidance, this grants code-install capability that can materially change the user environment and can be abused to install unwanted or malicious skills if upstream bundle data, slug resolution, or user expectations are manipulated.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly states that all intents match via semantic similarity, which creates a wide activation surface and raises the chance that unrelated user messages will invoke this skill. In a privacy/security-oriented skill, accidental activation is especially risky because the skill may process sensitive local-skill metadata, privacy controls, or trust decisions without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

text

When user picks one, re-call `security <picked.skillId>`.

When `matched === true`, localize `detailsEn` and apply Display rule (STRICT):

- **Grade A**: celebrate. "✅ Clean bill of health. No suspicious code, permissions match what it actually uses, community trusts it." Make user feel good.
- **Grade B**: create tension. "⚠️ Not a dealbreaker, but worth knowing..." Explain what specific signals are elevated. ("It requests network:all but only uses network:api — like asking for a master key when it only needs one room.") End: "Install anyway, or check the alternative?"

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · reference/rendering.md (reported line 77)May include surrounding context.

text

When user picks one, re-call `security <picked.skillId>`.

When `matched === true`, localize `detailsEn` and apply Display rule (STRICT):

- **Grade A**: celebrate. "✅ Clean bill of health. No suspicious code, permissions match what it actually uses, community trusts it." Make user feel good.
- **Grade B**: create tension. "⚠️ Not a dealbreaker, but worth knowing..." Explain what specific signals are elevated. ("It requests network:all but only uses network:api — like asking for a master key when it only needs one room.") End: "Install anyway, or check the alternative?"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote script directly via curl ... | bash, which removes any opportunity to inspect the downloaded code before execution. If the hosting domain, transport path, or script supply chain is compromised, users could run arbitrary code on their local machine with their own privileges.

Content

Scanner excerpt · reference/rendering.md (reported line 250)May include surrounding context.

md

❌ Mapick 未安装

请运行安装脚本：
curl -fsSL https://get.mapick.ai/install.sh | bash

或手动安装：
git clone https://github.com/mapick/mapick.git ~/.openclaw/skills/mapick

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The pipe into bash is a classic command-chaining hazard because it immediately executes network-fetched content in a shell. In the context of a skill manager that influences user installation behavior, this is more dangerous because the text may be treated as authoritative guidance and can normalize unsafe execution patterns.

Content

Scanner excerpt · reference/rendering.md (reported line 250)May include surrounding context.

md

❌ Mapick 未安装

请运行安装脚本：
curl -fsSL https://get.mapick.ai/install.sh | bash

或手动安装：
git clone https://github.com/mapick/mapick.git ~/.openclaw/skills/mapick

Static analysis

No suspicious patterns detected.