OpenMAIC

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 4:58 AM UTC
• Version: 0.3.13

Overview

The skill is a disclosed OpenMAIC setup and generation guide; it uses network calls, local config, and uploads in ways that match that purpose.

Install only if you are comfortable with OpenMAIC receiving the classroom requirement, any uploaded materials, and the Live Demo access code when using open.maic.chat. Keep API keys in local config or the web app as directed, review commands before approving installs or Docker startup, and avoid uploading sensitive documents unless the configured OpenMAIC service is appropriate for them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/extend.md (reported line 52)May include surrounding context.

md

Each is tagged with where it bites: **[product/fork]** (working inside the OpenMAIC repo), **[SDK]** (consuming packages in a separate app), or **[both]**.

- **[product/fork] `dist/` is gitignored in a source checkout.** In a fork/monorepo, each `@openmaic/*` package ships source only; its `dist/` is produced by `postinstall` (builds `dsl → generation → storage → importer → renderer → editor` in dependency order). If you `git clean -fdx` or nuke `node_modules`, re-run `pnpm install` or the packages won't resolve. (Published npm packages — the [SDK] path — ship built `dist/`, so this does not apply there.)
- **[product/fork] The vendor bundle is asserted before build.** `pnpm build` runs `node scripts/assert-vendor-maic-importer.mjs && next build`. That guard `stat()`s `public/vendor/maic-importer/index.js`; if missing/empty it exits 1 with an actionable message. `postinstall`'s `sync-maic-importer.mjs` step populates it — re-run `pnpm run sync:maic-importer` if you cleared it.
- **[product/fork] `workspace:*` are symlinks.** Inside the monorepo, `@openmaic/*` resolve to live `packages/@openmaic/*` source via pnpm workspace links. Editing a package's `src/` is picked up on its next build — but consumers see the built `dist/`, not `src/`, so rebuild the package after source changes.
- **[both] The renderer hard-depends on Tailwind v4.** `@openmaic/renderer` has `tailwindcss: ">=4"` as a peer. Tailwind v4 uses `@theme`/`@source` CSS directives, not a JS config — see [extend-cookbook.md](extend-cookbook.md) (branding) before touching styles.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/provider-keys.md (reported line 29)May include surrounding context.

Start from the example in the repository:

bash

cp .env.example .env.local
cp openmaic.example.yml openmaic.yml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

- Only that server-side configuration may control provider selection and defaults.
- Do not default to asking the user to paste API keys into chat.
- Prefer guiding the user to edit local config files themselves.
- Do not offer to write API keys into config files on the user's behalf.
- Once setup is complete and the user clearly asks to generate a classroom, do not ask for a second confirmation before submitting the generation job.
- Keep confirmations for local file reads such as reading a PDF from disk before uploading it.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The heading explicitly presents the skill as Chinese-language content '(二次开发)', and substantial instruction text below is written in Chinese without indicating that users may choose another language. This can violate language/locale policy when the skill implicitly requires a specific language without opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/generate-flow.md (reported line 22)May include surrounding context.

md

> request below (it also carries the owner cookie, see the next section):
>
> ```bash
> curl -c cookies.txt -b cookies.txt -X POST {url}/api/access-code/verify \
>   -H 'Content-Type: application/json' -d '{"code":"<ACCESS_CODE>"}'
> ```
>

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L034 states that 'The course language follows the requirement (and any uploaded material); there is no language field.' This hard-codes locale/language behavior without offering the user an explicit language selection or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to automatically read a sensitive access code from the user's local config and transmit it in Authorization headers to a remote service, without an explicit consent or privacy notice at the moment of use. Although using a bearer token is functionally necessary for the live demo API, silent retrieval and use of a local secret increases the risk of unintended credential use, especially if the user did not expect the skill to access local configuration or contact a third-party host.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

## Access Code Setup

1. Read `accessCode` from skill config (`~/.openclaw/openclaw.json` → `skills.entries.openmaic.config.accessCode`).
2. If found, use it directly. Do not ask the user to paste the code into chat.
3. If not found, tell the user how to get an access code and where to put it:
   - Get your access code: sign in at https://open.maic.chat, click your account in the top-right corner, open "访问码设置" (access code settings), and generate a code (starts with `sk-`).
   - Add it to the config file: edit `~/.openclaw/openclaw.json` and set `skills.entries.openmaic.config.accessCode` to your access code.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/live-demo.md (reported line 8)May include surrounding context.

md

## Access Code Setup

1. Read `accessCode` from skill config (`~/.openclaw/openclaw.json` → `skills.entries.openmaic.config.accessCode`).
2. If found, use it directly. Do not ask the user to paste the code into chat.
3. If not found, tell the user how to get an access code and where to put it:
   - Get your access code: sign in at https://open.maic.chat, click your account in the top-right corner, open "访问码设置" (access code settings), and generate a code (starts with `sk-`).
   - Add it to the config file: edit `~/.openclaw/openclaw.json` and set `skills.entries.openmaic.config.accessCode` to your access code.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly states that fonts.css fetches CJK font files on demand from https://file.maic.chat/fonts/<name>.woff2, which causes automatic third-party network requests during rendering. Even if the fetched asset is only a font, this can disclose user IP address, user agent, timing, and usage context, and may violate privacy, offline, or regulated-environment expectations when consumers follow the setup verbatim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.