Documentation-Accurate Code Generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 PM UTC
• Version: 1.0.0

Overview

The skill’s documentation-checking purpose is understandable, but it asks for an unexplained API credential and installs an apparently unnecessary unpinned npm package.

Review this skill before installing. Its core idea is benign, but the publisher should remove or justify BRAVE_API_KEY, remove or pin the axios dependency, narrow the 'always use' trigger, and require explicit user review before any skill updates or broad cross-skill documentation reads.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned and Unnecessary npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-15
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: npm
    kind: node
    package: axios
    bins: ["axios"]

Technical Analysis

The skill requests installation of axios without specifying an exact version or package integrity hash. Consequently, the package contents resolved during installation may differ from those reviewed or tested by the skill author.

Installing a mutable package version creates a supply-chain trust boundary. If the registry package, publisher account, dependency graph, or package resolution process is compromised, package-controlled lifecycle behavior could run with the privileges of the skill installer.

The declaration also identifies axios as an executable binary, although Axios is ordinarily consumed as a JavaScript library. No content in SKILL.md uses Axios, and the documented workflow relies on tools such as web_fetch, curl, and read. This inconsistency increases the likelihood that the dependency is unnecessary or incorrectly configured.

Attack Path

1. A user installs or enables the skill.
2. The OpenClaw installer processes the npm installation declaration.
3. The package manager resolves the current package version because no exact version or integrity value is provided.
4. A compromised or unexpectedly changed package release is downloaded.
5. Package-controlled installation behavior executes in the installer context, where applicable.
6. Malicious package behavior could access files, environment variables, or network resources available to that context.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the package installation process. The resulting scope depends on how OpenClaw performs installation and may include access to user files, environment variables, network credentials ...[truncated 207 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the Axios installation declaration if it is not required by an actual implementation.
2. If Axios is required, pin it to an audited exact version rather than resolving the latest compatible release.
3. Use a lockfile and verified package integrity hash to make dependency resolution reproducible.
4. Review the complete transitive dependency tree and package lifecycle scripts before distribution.
5. Remove bins: ["axios"] unless a reviewed package version demonstrably provides and requires that executable.
6. Prefer the platform's existing documentation-fetching tools instead of adding a redundant third-party dependency.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:8

Finding

Unnecessary Exposure of a Brave API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-10
Vulnerability Type: Excessive credential access that violates least privilege
Risk Level: Low

Vulnerable Code

yaml

requires:
  bins: ["curl", "jq", "git"]
  env: ["BRAVE_API_KEY"]

Technical Analysis

The skill declares BRAVE_API_KEY as a required environment variable, but the documented workflow does not describe Brave Search, provide a Brave API request, or otherwise establish a functional need for this credential.

Providing a secret to a skill execution environment expands the sensitive data available to commands and tools invoked in that environment. Any process running with access to the inherited environment may potentially read the key. This violates least-privilege principles because the stated task—loading and validating documentation—can be performed using the documented read, web_fetch, and local help mechanisms without a Brave API credential.

No active credential theft or exfiltration instruction was found in the audited file. The issue is unnecessary credential exposure rather than demonstrated misuse.

Attack Path

1. A user provisions BRAVE_API_KEY to satisfy the skill metadata requirements.
2. OpenClaw makes the environment variable available to the relevant skill or tool execution context.
3. Commands launched in that context inherit or otherwise gain access to the credential.
4. Malicious dependency behavior, a compromised external tool, or a later unsafe modification to the skill could read the environment variable.
5. The exposed key could then be used against Brave services within the permissions and quota assigned to it.

Impact Assessment

The directly exposed privilege is access to the Brave API account represented by the key. Potential consequences include unauthorized API requests, quota consumption, billing impact, service disruption, and access to any account capabilities granted to that key.

This declaration does not by itse ...[truncated 145 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove BRAVE_API_KEY from the required environment variables unless the skill has a documented and necessary Brave Search feature.
2. If Brave integration is added, make the credential optional and request it only when that specific functionality is invoked.
3. Restrict the key to the minimum required API permissions, quota, and service scope.
4. Prevent child processes and unrelated tools from inheriting the credential where the runtime supports environment isolation.
5. Never print, log, persist, or include the key in generated documentation references.
6. Document the exact endpoint, purpose, data flow, and retention behavior associated with any future use of the credential.
7. Rotate any key that may previously have been exposed to an unnecessarily broad execution context.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The 'Self-evolution: Update skills with doc validation' guidance endorses modifying skills, which is a form of self-modification. In an agentic environment, this can let the model alter its own behavior or other skills based on external documentation, potentially persisting prompt injection, weakening safeguards, or changing future execution behavior without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

### With Other Skills
- **Coding skill**: Use this for doc-accurate code
- **Self-evolution**: Update skills with doc validation
- **Content generation**: Generate accurate code examples
- **Research**: Research APIs from actual docs

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description and metadata instruct the system to use this skill for essentially any code generation, API use, or configuration task. Such broad activation criteria can cause the skill to be invoked in contexts where network access, external documentation fetching, or tool execution are unnecessary, increasing attack surface and creating more opportunities for prompt injection through untrusted docs or command output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The repeated 'ALWAYS' directives make the skill's activation policy effectively unconditional for a very large class of tasks. This reduces operator discretion and can force unnecessary documentation fetching, command execution, or validation steps even when inappropriate, which increases the chance of unsafe tool use and exposure to adversarial content.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 84% confidence

Finding

The skill includes generic instructions to read other skills' documentation and examples, which facilitates skill enumeration. In environments where available skills are sensitive or access-controlled, this can leak capability inventory and provide an attacker with reconnaissance information about additional tools, behaviors, or privileged workflows.

Content

Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.

Skill Documentation

bash

# Read skill docs
read("skills/skill-name/SKILL.md")

# Check skill examples
read("skills/skill-name/examples/")

Static analysis

No suspicious patterns detected.