Security audit

Skill Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a guide for installing other OpenClaw skills, but its install instructions send users to unpinned npm tools and arbitrary GitHub repositories that become active skills without enough provenance or rollback guidance.

Review and pin exact package versions or commit hashes before following these instructions. Prefer installing only reviewed skills from trusted sources, stage GitHub skills outside the active OpenClaw skill directory first, avoid running npm or npx with elevated privileges, and remove any installed skill or global CLI you do not trust.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned npm Packages Are Installed or Executed Without Integrity Verification
Content: View full analysis
/ ``` ### Technical Analysis The documented commands install or execute npm packages without pinning an audited version, verifying an integrity hash, or using a lockfile. Consequently, the code that runs can differ over time even when users follow the same instructions. Both global npm installation and `npx` execution may run package code and npm lifecycle scripts. In particular, `npx clawdhub ...` can retrieve and immediately execute a package that is not already installed locally. If the package registry account, release process, or package itself is compromised, attacker-controlled code could run under the invoking user's account. The `clawdhub` package name should also be independently verified against the intended ClawHub publisher and official documentation. A branding or package-name mismatch can increase exposure to typosquatting or dependency-confusion attacks. ### Attack Path 1. An attacker compromises the referenced npm package, its publisher account, or its release pipeline; alternatively, a user is directed to an unintended similarly named package. 2. The attacker publishes a malicious package version or adds malicious lifecycle behavior. 3. A user follows the documented unpinned `npm install -g` or `npx` command. 4. npm retrieves the current package version from the registry without validating it against a project-controlled lockfile or expected digest. 5. Malicious lifecycle scripts or CLI code execute with the privileges of the invoking user. 6. The malicious package can access files and credentials available to that user, modify local configuration, or install attacker-controlled Agent Skills. ### Impact ...[truncated 537 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Arbitrary GitHub Repositories Are Cloned Directly into the Active Skill Directory
Content: View full analysis
/.git ~/.openclaw/workspace/skills/ ``` ### Technical Analysis The installation guidance accepts an arbitrary repository owner and repository name and clones the repository's mutable default branch directly into OpenClaw's skill directory. It does not require an immutable commit hash, signature verification, repository allowlisting, content review, or quarantine before activation. Because a branch can change after the instructions have been reviewed, the effective skill content retrieved by the command is not fixed. A malicious or compromised repository can contain hostile skill instructions, unsafe installation scripts, or other files that may influence the Agent or be executed during subsequent skill setup and use. The clone operation itself only writes repository content and does not, based on the audited file, automatically execute it. Exploitation therefore depends on OpenClaw loading the installed skill or the user running scripts supplied by that repository. ### Attack Path 1. An attacker publishes a malicious skill repository, compromises a legitimate repository, or compromises its maintainer account. 2. The attacker places hostile instructions or scripts on the repository's default branch. 3. A user follows the documented command and clones that mutable branch directly into `~/.openclaw/workspace/skills/`. 4. The skill is subsequently discovered or loaded by OpenClaw, or the user executes its installation scripts as directed. 5. Attacker-controlled instructions can affect Agent behavior, while attacker-controlled scripts can execute with the invoking user's privileges. 6. Depending on the payload, the attacker may access Agent-visible data, user files, API credentials, or modify other user-owned skills a ...[truncated 690 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title and core instructional content are presented in Chinese, while the skill description metadata is in English, and there is no note that the skill is intended only for Chinese-speaking users or any option to choose another language. This creates a natural-language locale policy issue because the skill effectively imposes a specific language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The documentation instructs users to run npx clawdhub install <owner>/<skill-name> without pinning a specific package version. This causes execution of whatever package version is current at install time, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.