Security audit

Openclaw Skill Zalo Sticker Mention

Security checks for vulnerabilities and agentic risk

Overview

The skill’s chat features are coherent, but it applies them by rewriting installed Zalo driver files across OpenClaw paths without enough scoping or confirmation.

Review before installing. Run this only in an isolated or test OpenClaw workspace where modifying the Zalo channel driver is acceptable, inspect which files will be changed, and keep the restore path available. Avoid running scripts/publish.js unless you are maintaining the package and have fixed the shell-command and unpinned-CLI risks.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish.js:18
Finding: Shell Command Injection in the Release Workflow
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/publish.js:50
Finding: Unpinned Third-Party CLI Execution During Publishing
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a chat-behavior customization, but the content explicitly instructs users to run a patch script that modifies local library files and supports restore behavior. That is a significant capability beyond the declared purpose and creates supply-chain and integrity risk because operators may execute filesystem-altering code they did not expect from a simple messaging skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a chat-behavior customization, but the content explicitly instructs users to run a patch script that modifies local library files and supports restore behavior. That is a significant capability beyond the declared purpose and creates supply-chain and integrity risk because operators may execute filesystem-altering code they did not expect from a simple messaging skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README instructs users to run a patch script that modifies installed channel driver files in their workspace, but it does not clearly warn that this operation alters third-party code and may affect integrity, updates, rollback safety, or future behavior. In a skill whose primary purpose is to patch messaging behavior, that omission materially increases the chance of users making sensitive code changes without informed consent or understanding the operational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill provides direct patch and restore commands without warning that they will alter the local environment, likely modify installed library code, and may affect system behavior outside the skill itself. Users may run these commands assuming they are harmless setup steps, increasing the chance of unintended code modification or persistence.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description suggests simple mention/sticker behavior, but the script scans multiple global/project directories and patches installed library files in place. That hidden scope expansion is dangerous because it changes shared dependencies for other bots/projects, creating unexpected persistence and cross-project side effects outside the declared skill boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script writes backups and overwrites installed library code automatically, without interactive confirmation, dry-run mode, or explicit operator acknowledgement. This is risky because executing the skill immediately mutates runtime dependencies and can silently alter behavior of shared environments, making rollback and change control harder.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a skill that tags senders in Zalo group chat and sends stickers based on keywords. This script instead automates repository commits, pushes Git tags, and publishes the package to ClawHub, which are software release capabilities not justified by the stated runtime purpose of the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The script invokes npx clawhub publish without pinning an exact package version, which allows execution of whatever clawhub version is resolved at runtime. If the upstream package is compromised, replaced, or unexpectedly changed, the release workflow could execute attacker-controlled code with the developer's local permissions during publishing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill automatically tags the sender in group chat and sends stickers by keyword. This patch also intercepts outgoing text beginning with '/search-sticker' and turns it into a sticker search/result listing feature, which is a separate user-facing behavior not described in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill hardcodes Vietnamese output messages for sticker search results and errors, which imposes a specific language on users regardless of their preferences. There is no opt-in, locale selection, or documented reason that this skill is intended only for Vietnamese-speaking contexts.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish.js:24