AI Newsletter Toolkit

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:29 AM UTC
• Version: 1.1.0

Overview

This skill is a short newsletter automation description with no bundled code; the main caution is an unpinned npx command users should verify before running.

Before installing or running it, verify the `openclaw` CLI source and consider pinning an exact reviewed version instead of relying on unversioned `npx`. Also review any connected Threads, email, GitHub, X, or scraping credentials before enabling real harvesting or distribution workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned npm Package May Execute Mutable Third-Party Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23
Vulnerability Type: Unpinned external package execution
Risk Level: Medium

Vulnerable Code

bash

## Usage
```bash
npx openclaw skill run ai-newsletter-toolkit --harvest "OpenClaw updates"

text

### Technical Analysis

The documented usage invokes the `openclaw` npm package through `npx` without specifying an exact package version. If the package is not available locally, `npx` may retrieve it from the configured npm registry and execute its package entry point.

The repository contains no lockfile, integrity hash, vendored implementation, or other mechanism that binds this command to the package version reviewed when the Skill was published. The effective executable payload can therefore change independently of this repository. A compromised package release, compromised publisher account, unsafe registry configuration, or malicious package substitution could cause the command to execute attacker-controlled code.

This is classified as `T08: Insecure Dependencies` because the risk originates from executing an unpinned third-party package through the npm supply chain. The project does not contain evidence that the current `openclaw` package is malicious; exploitation depends on compromise or substitution of the resolved dependency.

### Attack Path

1. An attacker compromises the package publisher, the package distribution channel, or a registry selected by the user's npm configuration.
2. The attacker publishes or serves a malicious version of the package resolved by the unversioned `openclaw` name.
3. A user follows the command documented in `SKILL.md`.
4. `npx` resolves the mutable package version and, when it is not already installed locally, may download it from the configured registry.
5. The package entry point or lifecycle behavior executes with the privileges and environment of the invoking user.
6. The malicious package can per
...[truncated 660 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact, reviewed version instead of resolving the latest available release, for example: npx --yes openclaw@<verified-exact-version> ....
• Verify the selected package name, publisher, provenance, and official registry location before documenting it.
• Maintain a lockfile with integrity metadata where the execution model supports one, and use deterministic installation such as npm ci.
• Prefer installing the verified dependency during a controlled build or setup phase rather than downloading and executing it implicitly at runtime.
• Configure npm to use a trusted registry and enforce package provenance, integrity, and allowlisting controls where available.
• Run the command in a least-privileged, isolated environment without unnecessary credentials or sensitive environment variables.
• Document the expected network, filesystem, and credential access required by harvesting and distribution operations.
• Re-audit the pinned package and its transitive dependencies before updating the documented version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The usage example invokes npx openclaw without pinning a specific package version, which allows whatever version is currently resolved from the registry to run. If the package is updated maliciously, compromised upstream, or a typo/package-resolution issue occurs, users following the documented command could execute unreviewed code on their systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.