SUPAH Research Intelligence

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:00 PM UTC
• Version: 1.3.0

Overview

This skill is a disclosed paid remote research wrapper, with some privacy and configuration risks users should understand before using it.

Install only if you are comfortable with a paid remote service receiving the research topics, claims, and URLs you submit. Keep SUPAH_API_BASE unset or set only to a trusted HTTPS endpoint, monitor x402 spending, and prefer a pinned or verifiable install source for higher-assurance environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:15
• Finding: Unpinned Remote Installation Source Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md`, lines 15-18 **Vulnerability Type**: Unpinned remote Skill installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### OpenClaw CLI ```bash openclaw skills install https://tools.supah.ai/skills/supah-research-intelligence ``` ``` ### Technical Analysis The documented installation command retrieves the Skill from a vendor-controlled URL without specifying an immutable version, source commit, cryptographic checksum, or signature. Consequently, the content installed by users can change after this audited revision has been reviewed. This is a supply-chain weakness rather than evidence that the currently audited files contain malicious code. Exploitation requires the remote distribution endpoint, its hosting infrastructure, or an associated publishing account to be compromised or operated maliciously. ### Attack Path 1. An attacker compromises the `tools.supah.ai` distribution service, its deployment pipeline, DNS resolution, or an authorized publisher account. 2. The attacker replaces the package available at the documented mutable URL with a modified Skill. 3. A user follows the installation instructions and runs the `openclaw skills install` command. 4. OpenClaw installs the modified content without the user verifying it against an audited digest or signature. 5. When the altered Skill is loaded or invoked, attacker-supplied instructions or executable components can run within the permissions granted to the agent. ### Impact Assessment The immediate scope is the integrity of the installed Skill. A substituted package could alter agent instructions, redirect network activity, misrepresent research results, or introduce executable scripts. The maximum practical impact depends on the permissions granted to OpenClaw and its runtime. Potential access is generally bounded by the operating-system account and agent tools under which the Skill runs; this f ...[truncated 85 chars]
• Remediation: ## Remediation Suggestions - Publish versioned, immutable release artifacts rather than directing users to a mutable endpoint. - Pin the installation source to a specific release or commit identifier. - Publish a SHA-256 or stronger digest for every release and require verification before installation. - Cryptographically sign release artifacts and document signature verification. - Use a trusted package registry or a repository release system with provenance attestations. - Configure the distribution service so previously published versions cannot be overwritten. - Document how users can compare the installed files with the reviewed source revision.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:11
• Finding: Unvalidated API Endpoint Override Allows Plaintext Transmission and Response Manipulation## Vulnerability Details **File Location**: `index.js`, lines 11-27 **Vulnerability Type**: Unvalidated configurable endpoint with HTTP fallback **Risk Level**: Medium ### Vulnerable Code ```js const API_BASE = process.env.SUPAH_API_BASE || 'https://api.supah.ai'; function apiRequest(path, params = {}) { return new Promise((resolve, reject) => { const queryString = new URLSearchParams(params).toString(); const url = `${API_BASE}${path}${queryString ? '?' + queryString : ''}`; const client = url.startsWith('https') ? https : http; client.get(url, { headers: { 'User-Agent': 'OpenClaw-SUPAH-Research/1.2.0' } }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { resolve({ error: 'Invalid response', raw: data }); } }); }).on('error', reject); }); } ``` ### Technical Analysis `SUPAH_API_BASE` is concatenated directly with an API path and is not parsed or validated. The client is selected through the weak test `url.startsWith('https')`; every other value is passed to Node.js's plaintext `http` client. If the environment variable is set to an `http://` endpoint, topics, claims, and submitted source URLs are placed in URL query parameters and transmitted without transport encryption. URL query parameters may also be retained in proxy, server, monitoring, and access logs. Responses received over HTTP have no TLS integrity or server authentication. An on-path attacker can therefore observe submitted content or replace the JSON response. Because response fields are printed as research conclusions and credibility results, manipulated data can be presented to users or downstream agents as legitimate intelligence. The environment variable must already be set or influenced for this path to be exploited. No code in the audited project independently modifies the envi ...[truncated 1338 chars]
• Remediation: ## Remediation Suggestions - Parse the configured endpoint with `new URL()` rather than concatenating strings. - Reject any protocol other than `https:`. - Prefer removing arbitrary endpoint overrides in production. If an override is required, enforce an explicit hostname allowlist. - Reject URLs containing embedded usernames or passwords. - Construct request URLs through the `URL` API to avoid ambiguous parsing: ```js const base = new URL(process.env.SUPAH_API_BASE || 'https://api.supah.ai'); if (base.protocol !== 'https:') { throw new Error('SUPAH_API_BASE must use HTTPS'); } if (base.hostname !== 'api.supah.ai') { throw new Error('Unapproved API hostname'); } const requestUrl = new URL(path, base); for (const [key, value] of Object.entries(params)) { requestUrl.searchParams.set(key, String(value)); } ``` - Send potentially sensitive topics and claims in HTTPS POST request bodies rather than query strings to reduce exposure through URL logging. - Set request timeouts and response-size limits to improve resilience against malicious or malfunctioning endpoints. - Validate HTTP status codes and the expected JSON response schema before presenting remote data as a successful result.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill presents itself as a research capability but the manifest indicates undeclared outbound access to api.supah.ai and payment behavior via x402 USDC micropayments, while core logic is effectively delegated to a remote service. This mismatch is dangerous because users and orchestrators may invoke the skill without realizing it can transmit prompts/data off-platform and trigger financial actions, creating risks of data exfiltration, unexpected charges, and reduced auditability of what the remote service actually does.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that the skill is powered by remote `api.supah.ai` research endpoints for web scraping, aggregation, and report generation, but it does not clearly warn users that their prompts, claims, URLs, and possibly retrieved content will be transmitted to a third-party service. In a research skill, users may submit sensitive targets, internal URLs, proprietary topics, or confidential claims for verification, so the lack of disclosure creates a meaningful privacy and data-handling risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares environment-variable and binary requirements in metadata but does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent runner may grant broader execution capability than a user expects, especially since env access can expose sensitive configuration and enable unreviewed runtime behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This CLI sends user-supplied research topics, claims, and URLs directly to a remote third-party API, but the operational warning about that disclosure is not shown at the point of use. Because users may submit sensitive internal topics, investigative leads, or private URLs, the tool can unintentionally exfiltrate confidential information off-host. The skill context increases concern because a research/intelligence tool is especially likely to be used with sensitive or proprietary queries.

Static analysis

No suspicious patterns detected.