Whale Pulse Monitor

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill is a simple disclosed market-monitoring skill, with the main caution that its documented run command uses an unpinned npx package.

Before installing, verify that `openclaw` is the expected official package and consider running a pinned audited version in a least-privileged environment. Treat the trading claims as informational and understand that the skill charges 0.25 USDC via x402.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-23
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The documented usage command is:

bash

npx openclaw skill run whale-pulse-monitor

Technical Analysis

The command invokes the openclaw npm package through npx without specifying an audited version or integrity constraint. If the package is unavailable locally, npx may resolve, download, and execute a mutable package from the configured npm registry.

Because neither a fixed version nor a lockfile or integrity hash is specified, the code executed by this command can differ from the code originally reviewed. This creates a supply-chain trust boundary in which package compromise, registry-account takeover, or an unexpectedly unsafe future release could result in arbitrary code execution.

The repository itself contains only SKILL.md; it does not include executable scripts or direct evidence that the current openclaw package is malicious. The risk arises from the unsafe, unpinned download-and-execute pattern.

Attack Path

1. An attacker compromises the relevant package, its publisher account, or another component in the package-resolution path.
2. The attacker publishes a malicious version that can be selected by the unpinned npx command.
3. A user follows the documented usage instructions.
4. npx resolves and downloads the attacker-controlled release when no trusted local version is available.
5. Package lifecycle hooks or runtime logic execute with the invoking user's privileges.

Impact Assessment

Successful exploitation could execute arbitrary code under the account running the command. Depending on that account's permissions and environment, the malicious package could access readable files, environment variables, developer credentials, wallet-related material, or network services; alter user-owned files; and make outbound network re ...[truncated 218 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openclaw to a specific, audited version rather than allowing mutable resolution, for example:

  bash

  npx --yes openclaw@<audited-version> skill run whale-pulse-monitor
  

• Prefer installing dependencies through a committed lockfile and executing the locked local binary.
• Verify package provenance and integrity through registry integrity metadata, trusted signatures, or approved checksums.
• Document the expected package publisher, official registry, source repository, and audited version.
• Disable or ignore dependency lifecycle scripts where operationally possible.
• Run the command in a least-privileged, isolated environment without unnecessary credentials or sensitive mounted files.
• Establish a controlled dependency-update process that reviews new releases before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The usage example invokes npx openclaw without pinning a specific package version. npx may fetch the latest published package at execution time, so a compromised upstream release, typo-squatted package, or unexpected breaking update could cause users to run unreviewed code on their systems. In a skill context, placing this command in the primary usage path makes the risk more actionable because users are likely to copy-paste it directly.

Content

No source excerpt is available for this finding.