Oraclaw Bandit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:15 AM UTC
• Version: 1.0.0

Overview

The skill's optimization purpose is clear, but its setup asks users to run an unpinned MCP command whose actual server code is not included for review.

Review this before installing. Only use a verified OraClaw MCP server source, pin dependencies or disable npx runtime installation, and run the MCP process with the minimum environment and file access needed for optimization calls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–49; vulnerable command on lines 45–46
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

json

{
  "mcpServers": {
    "oraclaw": {
      "command": "npx",
      "args": ["tsx", "path/to/oraclaw-mcp/index.ts"]
    }
  }
}

Technical Analysis

The MCP configuration launches tsx through npx without specifying an exact package version. Depending on the local npm and npx configuration, this can cause the package to be resolved or downloaded from an external npm registry at execution time. The project provides no dependency manifest, lockfile, integrity hash, or vendored copy that constrains which tsx release will execute.

The referenced path/to/oraclaw-mcp/index.ts implementation is also absent from the audited project. Consequently, neither the remotely resolved execution dependency nor the MCP server code ultimately run by it can be verified from the available artifact.

This is an avoidable software supply-chain risk. If the registry package, one of its transitive dependencies, or the dependency-resolution process is compromised, attacker-controlled code could execute under the account running the MCP client.

Attack Path

1. A user follows the documented MCP configuration.
2. The MCP client starts the configured npx tsx path/to/oraclaw-mcp/index.ts command.
3. If tsx is unavailable locally, or resolution otherwise permits remote retrieval, npx resolves or downloads an unpinned package and its dependencies.
4. A compromised package release or transitive dependency executes attacker-controlled initialization or runtime code.
5. That code runs with the privileges and environment of the MCP client process.
6. The malicious code can access resources available to that process, potentially including local files, network connectivity, and exposed environment variables such ...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

1. Add the MCP implementation to the reviewed project so the executed source can be audited.

2. Declare tsx as a local development dependency using an exact, reviewed version rather than resolving it implicitly at runtime.

3. Commit a dependency lockfile and use deterministic installation such as npm ci.

4. Enforce dependency integrity verification and review both direct and transitive dependencies.

5. Invoke only the locally installed executable. If npx remains necessary, disable package installation, for example:

   json

   {
     "mcpServers": {
       "oraclaw": {
         "command": "npx",
         "args": ["--no-install", "tsx", "path/to/oraclaw-mcp/index.ts"]
       }
     }
   }
   

6. Prefer a fixed local executable path or a packaged, integrity-verified release over runtime package resolution.

7. Run the MCP server with least privilege and expose only the environment variables, files, and network destinations it requires.

8. Add automated dependency scanning and controlled upgrade review to detect compromised or vulnerable releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.