Sovereign Liquidity Sniffer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

The skill is a small, coherent market-scanner description with no bundled executable code, but users should be careful with the unpinned npx command.

Before installing or running, prefer a pinned and trusted OpenClaw CLI version and confirm the payment/service provider is reputable. Treat the trading-performance claims as unverified because this artifact does not include auditable scanner code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

npx openclaw skill run sovereign-liquidity-sniffer --target BTC

Technical Analysis

The documented command invokes the openclaw package through npx without specifying an exact package version, verifying an integrity hash, or identifying an authoritative package source. If the package is not already available locally, npx may retrieve executable package content from the configured package registry.

This project contains only SKILL.md; it does not include the package implementation, a dependency lockfile, or integrity metadata. Consequently, the executable code invoked by the documented command is outside the audited artifact and can change independently after review.

This is a supply-chain weakness rather than evidence that the current openclaw package is malicious. Exploitation would require the package source, registry resolution, maintainer account, or a subsequently published version to become malicious or compromised.

Attack Path

1. An attacker compromises the package publisher, registry account, package distribution channel, or dependency resolution environment.
2. The attacker publishes or causes resolution to a malicious version of the unpinned openclaw package.
3. A user follows the command documented in SKILL.md.
4. npx retrieves the mutable package version when it is not already installed locally.
5. Package lifecycle behavior or the invoked CLI executes attacker-controlled code with the privileges of the user running the command.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's account. Depending on that account's permissions and environment, the payload could read or modify user-accessible files, access environment variables and credentials, make network requests, or alter local deve ...[truncated 287 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openclaw to an exact, reviewed version rather than relying on mutable default registry resolution.
• Install dependencies through a committed lockfile that records package versions and integrity values.
• Verify the package's authoritative name, publisher, registry, provenance, and cryptographic integrity before execution.
• Prefer a controlled installation step followed by offline or immutable execution, rather than permitting npx to fetch code during normal use.
• Disable or carefully review package lifecycle scripts where operationally possible.
• Document the trusted registry and installation procedure, including how users should verify package signatures or checksums.
• Include the actual scanner implementation or a verifiable reference to its reviewed source so that the behavior claimed by the skill can be audited.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The usage example invokes npx openclaw without pinning an exact package version, which can cause users to fetch and execute whatever package version is current at runtime. If the upstream package, dependency chain, or namespace is compromised, users could unintentionally run malicious code on their systems.

Content

No source excerpt is available for this finding.