Trade Show Lead Recommender

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.2.1

Overview

The skill itself is a coherent Lensmor API helper, but its install instructions tell users to bypass a ClawHub risk warning for an unpinned personal-scope package.

Review the install source before using this skill. The API behavior is purpose-aligned, but do not blindly run the README install command with --acknowledge-clawhub-risk; prefer a pinned, verified release from a publisher you trust, and provide LENSMOR_API_KEY only if you are comfortable sending authenticated event and filter queries to Lensmor.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Installation Instructions Bypass the ClawHub Risk Warning

Content

View full analysis

Vulnerability Details

File Location: README.md:31-35
Vulnerability Type: Supply-chain risk caused by bypassing a package-registry warning
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
openclaw skills install @weilun88313/trade-show-lead-recommender --acknowledge-clawhub-risk

text

### Technical Analysis

The documented installation command includes `--acknowledge-clawhub-risk`, which instructs the installer to proceed despite a ClawHub risk warning. The package is referenced through a mutable registry identifier under the personal publisher scope `@weilun88313`, while the project presents Lensmor branding. The instructions do not pin an immutable package version, verify a checksum or signature, or provide a procedure for confirming publisher ownership.

A warning-acknowledgment option is not independently proof that the referenced package is malicious. However, recommending it as the standard installation path weakens an existing supply-chain control and encourages users to accept package content that may differ from the files reviewed in this audit.

### Attack Path

1. An attacker compromises the publisher account, obtains control of the referenced package, or publishes a harmful release through another supply-chain failure.
2. The attacker adds malicious instructions, scripts, or configuration to the mutable registry package.
3. A user follows the README and runs the installation command with `--acknowledge-clawhub-risk`.
4. The installer suppresses or accepts the relevant risk boundary and retrieves the current package release rather than an immutable, audited artifact.
5. The malicious package is installed and can operate with the permissions available to the OpenClaw process when loaded or invoked.

### Impact Assessment

The precise impact depends on the contents of a compromised package and the privileges granted to the OpenClaw runtime. Potential scope includes modi
...[truncated 530 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --acknowledge-clawhub-risk from the default installation command and require users to investigate unresolved warnings rather than bypass them.
2. Publish the skill under a verified Lensmor organization scope so package ownership is consistent with project branding.
3. Pin installation instructions to a specific immutable version instead of allowing resolution to an arbitrary future release.
4. Provide a cryptographic checksum, signed release, or registry-supported provenance record and document how users should verify it before installation.
5. Link the package release to the corresponding source revision so users can confirm that registry content matches the reviewed repository.
6. If acknowledgment remains unavoidable, explain the exact reason for the warning, its security implications, and the verification steps users must complete before proceeding.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

- Need outreach → `booth-invitation-writer`
- Need an event-level go/no-go decision → `trade-show-fit-score`

## Output Rules

1. Never output `LENSMOR_API_KEY` or raw authorization headers.
2. Do not call results AI-ranked unless recommendation metadata is populated.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

- Lensmor API key (`sk_your_api_key`) from Lensmor Settings → API Keys
- Base URL: `https://platform.lensmor.com`
- [Lensmor API docs](https://api.lensmor.com/)

## Install

Static analysis

No suspicious patterns detected.