Wrike

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:56 PM UTC
• Version: 0.1.0

Overview

This Wrike skill is purpose-aligned and openly describes its Wrike access, but users should treat its unpinned npm CLI dependency and stored Wrike token with care.

Install only if you trust the claw-wrike npm package and can use a least-privilege Wrike token. Review the token scope, expect local token storage, and use the documented dry-run and read-before-update workflow before making changes to live Wrike data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned and Unverifiable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "📋", "requires": {"bins": ["claw-wrike"], "env": ["WRIKE_TOKEN"]}, "primaryEnv": "WRIKE_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "claw-wrike", "bins": ["claw-wrike"], "label": "Install claw-wrike (npm)"}]}}

Technical Analysis

The installation metadata identifies the npm package claw-wrike without specifying an exact version, package integrity hash, verified publisher, or authoritative source repository. Consequently, installation can resolve to a mutable package release whose contents may differ from the version originally reviewed.

The project contains only SKILL.md; it does not include the source code of the claw-wrike executable. The executable's installation scripts, runtime behavior, network destinations, and handling of WRIKE_TOKEN therefore cannot be verified from the audited artifact.

This is a supply-chain weakness rather than proof that the current npm package is malicious. Exploitation would require compromise or malicious control of the referenced package, its publisher account, or the package-resolution process.

Attack Path

1. An attacker compromises the npm package, publisher credentials, or another component of the package distribution chain.
2. The attacker publishes a malicious release under the referenced claw-wrike package name.
3. Because no exact version or integrity value is specified, a subsequent installation resolves to the malicious release.
4. Package lifecycle scripts may execute during installation, or malicious logic may execute when the agent invokes claw-wrike.
5. The malicious package accesses resources available to the process, potentially including WRIKE_TOKEN, local user files, and authenticated Wrike operations.
6. The package ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin claw-wrike to an exact, reviewed version rather than allowing mutable package resolution.
2. Record and verify the package integrity hash before installation.
3. Document the package's authoritative source repository and verify that published artifacts correspond to reviewed source.
4. Audit package lifecycle scripts and disable npm installation scripts where they are unnecessary.
5. Prefer vendoring or otherwise incorporating reviewed executable source into a reproducible build process.
6. Run the CLI with least privilege and issue a Wrike token limited to the minimum required account scope.
7. Isolate the CLI from unrelated local files and sensitive environment variables.
8. Continuously monitor the pinned package and its transitive dependencies for ownership changes, malicious releases, and disclosed vulnerabilities.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.