OpenMAIC

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 10:23 AM UTC
• Version: 0.3.5

Overview

This is a coherent OpenMAIC setup and generation guide with expected credential and cloud-use caveats, but no hidden or destructive behavior in the skill artifact.

Before installing, understand that Live Demo mode uses a stored OpenMAIC access code and sends generation requests, and any uploaded or parsed classroom material, to `open.maic.chat`. Keep the access code in local config rather than chat, and only enable server-side persistence, optional media/search providers, or remote font loading if those data flows are acceptable for your classroom content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Each is tagged with where it bites: **[product/fork]** (working inside the OpenMAIC repo), **[SDK]** (consuming packages in a separate app), or **[both]**.

- **[product/fork] `dist/` is gitignored in a source checkout.** In a fork/monorepo, each `@openmaic/*` package ships source only; its `dist/` is produced by `postinstall` (builds `dsl → generation → storage → importer → renderer → editor` in dependency order). If you `git clean -fdx` or nuke `node_modules`, re-run `pnpm install` or the packages won't resolve. (Published npm packages — the [SDK] path — ship built `dist/`, so this does not apply there.)
- **[product/fork] The vendor bundle is asserted before build.** `pnpm build` runs `node scripts/assert-vendor-maic-importer.mjs && next build`. That guard `stat()`s `public/vendor/maic-importer/index.js`; if missing/empty it exits 1 with an actionable message. `postinstall`'s `sync-maic-importer.mjs` step populates it — re-run `pnpm run sync:maic-importer` if you cleared it.
- **[product/fork] `workspace:*` are symlinks.** Inside the monorepo, `@openmaic/*` resolve to live `packages/@openmaic/*` source via pnpm workspace links. Editing a package's `src/` is picked up on its next build — but consumers see the built `dist/`, not `src/`, so rebuild the package after source changes.
- **[both] The renderer hard-depends on Tailwind v4.** `@openmaic/renderer` has `tailwindcss: ">=4"` as a peer. Tailwind v4 uses `@theme`/`@source` CSS directives, not a JS config — see [extend-cookbook.md](extend-cookbook.md) (branding) before touching styles.

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

For first setup, prefer `.env.local`:

```bash
cp .env.example .env.local
```

Then fill the chosen keys.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Only OpenMAIC server-side config files may control provider selection and defaults.
- Do not default to asking the user to paste API keys into chat.
- Prefer guiding the user to edit local config files themselves.
- Do not offer to write API keys into config files on the user's behalf.
- Once setup is complete and the user clearly asks to generate a classroom, do not ask for a second confirmation before submitting the generation job.
- Keep confirmations for local file reads such as reading a PDF from disk.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users how to enable server-side persistence and notes that data will be persisted to PostgreSQL/S3, but it does not present this as an explicit privacy/security warning or require informed acknowledgment before switching away from browser-local storage. In an agent skill context, that omission can lead users to enable remote storage without appreciating that classroom content, runtime state, and assets may leave the local device and be retained on external infrastructure.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file states that the optional `language` field defaults to `"zh-CN"` and that unsupported values silently fall back to `"zh-CN"`. This imposes a specific locale by default rather than offering user choice or requiring explicit opt-in, which matches the language/locale policy violation criteria.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to read a bearer access code from a local config file and use it for authenticated requests, but it does not include explicit safeguards about secret handling, minimal disclosure, or requiring clear user consent before accessing local sensitive configuration. In an agent context, this can normalize silent credential access and increase the risk of unintended secret use, logging, or propagation to other tools or prompts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Access Code Setup

1. Read `accessCode` from skill config (`~/.openclaw/openclaw.json` → `skills.entries.openmaic.config.accessCode`).
2. If found, use it directly. Do not ask the user to paste the code into chat.
3. If not found, tell the user how to get an access code and where to put it:
   - Get your access code: sign in at https://open.maic.chat, click your account in the top-right corner, open "访问码设置" (access code settings), and generate a code (starts with `sk-`).
   - Add it to the config file: edit `~/.openclaw/openclaw.json` and set `skills.entries.openmaic.config.accessCode` to your access code.

• Confidence: 82% confidence
• Finding: The instruction to automatically read `accessCode` from a local config and use it directly encourages autonomous handling of sensitive credentials without an explicit permission step at time of use. In an agentic environment, that reduces user awareness and control over local secret access, which can lead to privacy and credential misuse risks even if the stated goal is convenience.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Access Code Setup

1. Read `accessCode` from skill config (`~/.openclaw/openclaw.json` → `skills.entries.openmaic.config.accessCode`).
2. If found, use it directly. Do not ask the user to paste the code into chat.
3. If not found, tell the user how to get an access code and where to put it:
   - Get your access code: sign in at https://open.maic.chat, click your account in the top-right corner, open "访问码设置" (access code settings), and generate a code (starts with `sk-`).
   - Add it to the config file: edit `~/.openclaw/openclaw.json` and set `skills.entries.openmaic.config.accessCode` to your access code.

• Confidence: 82% confidence
• Finding: The instruction to automatically read `accessCode` from a local config and use it directly encourages autonomous handling of sensitive credentials without an explicit permission step at time of use. In an agentic environment, that reduces user awareness and control over local secret access, which can lead to privacy and credential misuse risks even if the stated goal is convenience.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The documentation explicitly states that `fonts.css` fetches CJK font files on demand from `https://file.maic.chat/fonts/<name>.woff2`. That creates an external network request from downstream apps, which can disclose user IP address, user agent, timing, and usage patterns, and may also break in restricted or offline environments. In SDK setup guidance, this is a real privacy and deployment concern even if not an exploit in the classic sense.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The title explicitly includes Chinese text '(二次开发)', and later guidance such as L17-L18 is written in Chinese while other sections are in English. This imposes a mixed-language experience without stating that the user can choose a preferred language, which can violate a language/locale policy requiring user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The instructions explicitly direct the user to open "访问码设置" in the account menu, which hardcodes a Chinese UI label without indicating that the interface language may vary or offering an alternative. This can violate language/locale policy when a specific language is imposed without user opt-in.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.