Artidrop

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:42 AM UTC
• Version: 1.3.5

Overview

The skill is a coherent publishing helper, but it needs Review because it auto-installs an unpinned third-party npm CLI that will handle user content and optional credentials.

Install only if you are comfortable with generated content being uploaded to Artidrop and handled by its CLI. Avoid publishing secrets, personal data, internal documents, or proprietary material unless you explicitly intend to share it, and prefer a pinned, reviewed Artidrop CLI version before broad use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Automatically Installed npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: { "openclaw": { "emoji": "🚀", "requires": { "bins": ["node"], "env": [{ "name": "ARTIDROP_API_KEY", "optional": true, "description": "API key for authenticated features (higher rate limits, update/delete/list). Not required for anonymous publishing." }] }, "install": [{ "kind": "node", "package": "artidrop", "bins": ["artidrop"], "label": "Install Artidrop CLI (npm)" }] } }

Technical Analysis

The skill installation metadata requests installation of the third-party artidrop npm package without specifying an exact version or integrity hash. Consequently, installation may resolve to whichever package release is current at that time rather than to a release whose contents were reviewed.

The audited project contains only SKILL.md and README.md; it does not include the CLI source, a package lockfile, or integrity metadata. The effective executable behavior of the installed dependency therefore cannot be verified from this repository. If a future package version or its publishing account is compromised, malicious package lifecycle logic or CLI behavior could run with the permissions available to the OpenClaw environment.

This finding concerns the unsafe dependency-resolution mechanism. The audit found no evidence that the current external package is malicious.

Attack Path

1. An attacker compromises the npm package publisher account, package distribution process, or a future release of artidrop.
2. The attacker publishes a malicious version under the same package name.
3. OpenClaw processes the skill's installation specification and resolves artidrop without an exact version constraint.
4. The malicious package is installed instead of a previously reviewed release.
5. Package installation logic or the installed artidrop executable runs in the agent environment. 6 ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin artidrop to an exact, independently reviewed version rather than resolving an unspecified release.
2. Verify the package using a trusted integrity digest or equivalent provenance mechanism.
3. Use a committed lockfile where the skill installation system supports one.
4. Review the package source, transitive dependencies, lifecycle scripts, and published-package provenance before approval.
5. Disable npm lifecycle scripts during installation where operationally feasible, or explicitly audit every required lifecycle script.
6. Run installation and invocation in a restricted sandbox with minimal filesystem access, limited network destinations, and no unrelated secrets.
7. Provide ARTIDROP_API_KEY only when authenticated functionality is required and scope the key to the minimum available permissions.
8. Establish dependency monitoring and repeat the review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes publishing generated content to shareable URLs but does not clearly warn that the content is uploaded to a third-party external service and exposed via a link. This omission is dangerous because users may unknowingly publish sensitive, proprietary, or personal data outside their local environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

Add your API key to your OpenClaw environment:

yaml

# In your openclaw config or .env
ARTIDROP_API_KEY=sk-your-api-key-here

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md

## Prerequisites

1. **Node.js** — already included in OpenClaw
2. **Artidrop API key** — sign in at [artidrop.ai](https://artidrop.ai), go to Settings > API Keys, and create one

## Installation

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README encourages broad natural-language triggers like 'publish', 'share', or 'host', which can cause the agent to invoke this skill in contexts where the user may not fully understand that content will be sent to an external publishing service. In a skill whose core function is external publication, ambiguous invocation guidance increases the risk of unintended data disclosure rather than direct code exploitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.