yoooclaw-meeting-preparations-en

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent meeting-briefing purpose, but it automatically installs an unpinned remote search skill and accesses notifications without enough user confirmation.

Review this skill before installing. It may read recent notification content about the people or topics you provide, search the web, and automatically add a remote web-search skill if missing. Only use it if you are comfortable with that access, and prefer a version that asks before installing dependencies and uses pinned, verified sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Package and Remote Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–44
Vulnerability Type: Unverified and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

1. Execute `openclaw skills list` and check whether `byted-web-search` is included in the output.
2. Installed: Continue normally.
3. Not installed: execute
   `npx skills add https://skills.volces.com/skills/bytedance/agentkit-samples -s byted-web-search --agent openclaw`
   - Installation successful: continue normally.
   - Installation failed: **Do not abort the entire briefing**. Make a note of "Internet search is not available", skip the networking part directly in the second step, generate a briefing using only the notification information, and prompt "Unable to search for external information online this time" at the end of the briefing.

Technical Analysis

The skill directs the agent to invoke the skills npm package through npx without specifying an immutable package version. It then installs skill content from a remote URL without pinning a commit, release, cryptographic checksum, or signature.

Consequently, the effective installer and downloaded skill content can change after this project has been reviewed. If the npm package, its dependency chain, the remote repository, the distribution infrastructure, or the associated maintainer account is compromised, an attacker could substitute malicious installer behavior or agent instructions.

This is an insecure supply-chain pattern because execution depends on mutable, externally controlled components that are not present in the audited artifact and cannot be verified from the project itself.

Attack Path

1. A user invokes the meeting-preparation skill on a system where byted-web-search is not installed.
2. The agent follows the prerequisite instructions and runs the documented npx skills add ... command.
3. npx resolves and retrieves an unpinned version of the skills packag ...[truncated 1209 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills npm package to a reviewed, exact version rather than allowing npx to resolve the current release.
2. Pin the remote skill to an immutable commit hash or signed release instead of a mutable repository URL.
3. Verify the downloaded package and skill content using trusted signatures or published SHA-256 checksums before installation.
4. Require explicit user or administrator approval before installing third-party dependencies.
5. Prefer vendoring the reviewed dependency into a controlled internal registry or local package so its contents are available during security review.
6. Lock and review all transitive dependencies, and use package-manager integrity metadata where supported.
7. Perform installation in a sandbox with minimal filesystem, credential, and network access.
8. Separate installation from ordinary skill execution so a missing optional search capability cannot silently trigger remote dependency acquisition.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are so broad that ordinary mentions of meetings, preparation, or related phrasing may trigger the skill unexpectedly. In this skill's context, accidental activation is more dangerous because the workflow includes notification searching, Internet lookup, and even dependency-check/install behavior, causing privacy exposure and possible system actions without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to execute local shell and package-management commands to inspect and install software, even though the stated purpose is only to prepare a meeting briefing. This expands the skill's privileges from information gathering into local system modification, enabling unintended code execution and persistence risks if the command path or remote package source is malicious or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes automatic shell execution and package installation without a user-facing warning or consent step. Because these actions can alter the host environment and execute third-party code, silently performing them violates least surprise and materially increases the risk of unauthorized code execution and environment tampering.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs the agent to run npx skills without any version pinning or integrity control. That allows execution of whatever package/version resolves at runtime, which can change over time or be compromised, creating a supply-chain and arbitrary code execution risk on the local system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The skill name includes an -en suffix indicating an English-specific variant, but the file does not state that language choice is optional or user-selectable. This can amount to a locale constraint without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.