SprintX OpenClaw Handoff

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 0.1.3

Overview

This skill is a narrow, disclosed SprintX handoff guide, with the main caution that it installs an unpinned external CLI and sends handoff metadata to SprintX.

Install this only if you intend to connect an existing OpenClaw runtime to SprintX. Review the SprintX project ID before running commands, avoid sending secrets or sensitive files as artifact references, prefer browser-approved sx auth, and consider pinning or separately reviewing @sprint-x/cli before global installation in controlled environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party CLI Is Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-13 and SKILL.md:52-56
Vulnerability Type: Unpinned global dependency installation
Risk Level: Medium

The skill declares and recommends installing the mutable latest release of a third-party npm package globally:

yaml

metadata:
  openclaw:
    requires:
      bins:
        - sx
    install:
      - kind: node
        package: "@sprint-x/cli"
        bins:
          - sx

The operator-facing installation instructions similarly omit an exact version:

bash

npm install -g @sprint-x/cli
sx --help

Technical Analysis

The package reference does not specify an exact reviewed version or integrity value. Consequently, npm install -g @sprint-x/cli resolves whichever release the npm registry serves under the package's current default distribution tag at installation time.

This makes the effective installed code mutable after the skill has been reviewed. The external CLI source and its npm lifecycle scripts are not included in this repository, so they cannot be verified by this audit. If the package, publisher account, release process, or registry resolution is compromised, npm could install and execute code different from the version originally assessed.

Global npm installation also places the resulting executable in a shared command location. Package lifecycle scripts, when present and enabled, execute during installation with the permissions of the user running npm.

Attack Path

1. An attacker compromises the @sprint-x/cli package, a maintainer or publisher account, or its release pipeline.
2. The attacker publishes a malicious release and assigns it to the registry tag resolved by an unversioned installation.
3. An operator follows the skill's documented command:

   bash

   npm install -g @sprint-x/cli
   

4. npm downloads the attacker-controlled release rather than a previously reviewed version.
5. M ...[truncated 1100 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @sprint-x/cli to an exact reviewed version in both the skill metadata and installation command:

   bash

   npm install -g @sprint-x/cli@0.1.3
   

   Replace the example version with the actual independently reviewed CLI release.

2. Keep the metadata and operator instructions synchronized so automated installation cannot silently resolve a different release from the documented command.

3. Document package provenance, the expected npm scope owner, and a procedure for verifying the package tarball and integrity digest before installation.

4. Prefer a lockfile-backed local installation where the runtime supports it. This allows npm integrity metadata and dependency versions to be reviewed and reproduced.

5. Consider disabling npm lifecycle scripts during installation with --ignore-scripts if the CLI does not legitimately require them. Test this configuration before recommending it.

6. Avoid privileged installation. Explicitly instruct operators not to run the installation through sudo or an administrative account.

7. Establish a release-review process that verifies the pinned CLI package, its transitive dependencies, lifecycle scripts, and published provenance before updating the version referenced by the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

### Access-token override

If the environment already injects an access token, SprintX CLI can skip browser auth.

Treat this as advanced or break-glass behavior only.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README includes example sx commands that send project identifiers, event metadata, and artifact references/content metadata to SprintX, but the example block itself does not clearly warn users that these actions disclose runtime and project information to an external service. In a handoff/integration skill this data flow is expected, but the missing explicit disclosure notice can still cause operators to transmit sensitive operational details without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

assertIncludes(
  skill,
  "Do not ask users to paste tokens into chat.",
  "skill must explicitly warn against token paste into chat"
);

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/check-contract.mjs (reported line 51)May include surrounding context.

js

assertIncludes(
  skill,
  "Do not ask users to paste tokens into chat.",
  "skill must explicitly warn against token paste into chat"
);