yoooclaw-meeting-preparations

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

The skill matches its meeting-prep purpose, but it can read phone notifications and automatically install an unpinned web-search skill without asking first.

Review this skill carefully before installing. It may be useful for meeting preparation, but only install it if you are comfortable with scoped searches over recent phone notifications and with the web-search dependency being preinstalled or approved through a controlled process rather than installed automatically at runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Unpinned Third-Party Skill Installation from a Mutable Remote Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-36
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: High

Vulnerable Code

markdown

1. Execute `openclaw skills list` and check whether the output contains `byted-web-search`.
2. If installed: continue normally.
3. If not installed: execute
   `npx skills add https://skills.volces.com/skills/bytedance/agentkit-samples -s byted-web-search --agent openclaw`
   - If installation succeeds: continue normally.
   - If installation fails: **do not terminate the entire briefing**. Record that "web search is unavailable," skip the web-search portion in Step 2, generate the briefing using notification information only, and state at the end that external information could not be searched.

Technical Analysis

The Skill directs the Agent to install executable third-party Skill content from a mutable remote URL whenever byted-web-search is absent. The command does not pin an immutable release, version, or commit and does not verify a checksum, cryptographic signature, publisher identity, or expected package contents.

Consequently, the content installed at execution time can differ from the content that was originally reviewed. The installation is also performed automatically without requesting explicit user authorization after the missing dependency is detected. If the remote source, distribution service, repository, or publisher account is compromised, malicious content could be delivered through this trusted installation path.

This is a supply-chain vulnerability rather than evidence that the current upstream package is malicious. The risk arises because the Skill automatically trusts mutable remote content and may execute it with the permissions available to the OpenClaw Agent.

Attack Path

1. An attacker compromises the upstream Skill source, its publisher account, the hosting service, or another c ...[truncated 1753 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an immutable dependency revision

   • Reference a specific reviewed release or commit hash instead of a mutable repository URL.
   • Prevent automatic resolution to the latest available upstream content.

2. Verify integrity and authenticity

   • Publish and validate a cryptographic checksum for the exact Skill artifact.
   • Prefer signed releases and verify the signature against a trusted publisher key.
   • Fail safely if identity or integrity verification cannot be completed.

3. Require explicit installation approval

   • Inform the user that a third-party Skill is missing and identify its source, requested version, and required permissions.
   • Require affirmative user approval before downloading or installing it.
   • Do not combine dependency installation and immediate execution without an intervening trust decision.

4. Review and restrict the dependency

   • Audit the pinned dependency before deployment.
   • Grant only the network, file, notification, and tool permissions required for web search.
   • Run the dependency in a sandbox with outbound-network restrictions and limited filesystem access.

5. Use a trusted dependency registry or allowlist

   • Install only dependencies whose publisher and immutable artifact are approved by the deployment administrator.
   • Maintain an allowlist containing expected package identifiers, versions, hashes, and signing identities.

6. Preserve the existing safe degradation path

   • If the verified dependency is unavailable, skip external search and generate the briefing from local notification results.
   • Clearly disclose that external search was omitted rather than installing unverified content automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is designed to search phone notifications and external web sources, but it does not require an explicit user-facing privacy notice or consent flow before processing potentially sensitive personal or workplace communications. This can expose private data unexpectedly and may also transmit query-derived sensitive context to external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to install another skill automatically via shell command, expanding its capabilities without explicit user consent. This is dangerous because installing a new skill can introduce arbitrary new code, permissions, or data flows unrelated to the immediate meeting-prep request, creating a clear capability-escalation and supply-chain attack surface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are very broad, causing the skill to trigger for common meeting-related language even when the user may not expect notification scraping or web searches. Over-broad routing increases the chance of unintended access to sensitive phone notifications and unnecessary external queries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill directs the agent to run npx skills add without pinning a specific version or immutable package source, which creates a supply-chain risk. If the referenced package, registry response, or dependency chain changes, the agent could execute unintended code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.