ai-news-oracle

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:26 PM UTC
• Version: 1.0.0

Overview

This skill is a simple AI news briefing integration with disclosed API and payment behavior, with only a supply-chain hygiene note about an unpinned GitHub install command.

Before installing, use a pinned commit or reviewed release if possible, and treat the external API and optional payment flow as third-party service interactions. The inspected artifact does not show malicious or hidden behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Installation from an Unpinned Remote Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41–46
Vulnerability Type: Supply-chain risk caused by a mutable remote dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## 📦 Installation

Using OpenClaw CLI:
```bash
openclaw install skill https://github.com/swimmingkiim/openclaw-skill-ai-news-oracle

text

### Technical Analysis

The installation command retrieves the Skill directly from the default state of a remote GitHub repository. It does not pin an immutable commit hash or verified release artifact, nor does it require signature or checksum verification.

Consequently, the content installed by this command can differ from the content originally reviewed. A malicious repository update, compromised maintainer account, or unauthorized repository modification could introduce executable scripts or harmful Skill instructions after the audit. The local artifact contains only `SKILL.md`, so the behavior of the remotely downloaded implementation cannot be validated from the audited project.

### Attack Path

1. An attacker compromises the referenced repository or its maintainer account, or a maintainer publishes a malicious update.
2. The attacker adds harmful Skill instructions, scripts, dependencies, or tool definitions to the repository's default branch.
3. A user follows the documented installation command.
4. OpenClaw retrieves the repository's current mutable state rather than an immutable, previously reviewed revision.
5. The modified Skill is installed and may execute with the permissions available to the OpenClaw process when loaded or invoked.

### Impact Assessment

The precise impact depends on the content introduced remotely and the permissions granted to the OpenClaw process. Potential scope includes manipulation of agent behavior, access to data available to the process, unauthorized network requests, and local command execution if the downloaded Skill is permi
...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an immutable, reviewed Git commit rather than the repository's default branch.
2. Prefer a versioned release artifact accompanied by a published SHA-256 or stronger cryptographic digest.
3. Verify the artifact checksum before installation and fail closed if verification does not succeed.
4. Require signed commits or signed release artifacts and document how users should validate the signature against a trusted maintainer key.
5. Vendor the exact reviewed Skill implementation into the distributed artifact where practical.
6. Review all remotely sourced scripts, tool definitions, dependencies, and lifecycle hooks before installation.
7. Run the installed Skill with least privilege, restricting filesystem access, credentials, subprocess execution, and outbound network access to only what is necessary.
8. Establish a controlled update process so later versions undergo security review before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.