Ai Intelligent Data Catalog

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:50 AM UTC
• Version: 1.0.0

Overview

This skill describes a plausible data-catalog tool, but its install steps run unpinned code from an external GitHub repository that is not included in the reviewed artifact.

Review or pin the external GitHub repository before installing, run it in an isolated environment without sensitive credentials, and avoid using it against private business data until the application source and dependencies are audited or distributed with verifiable hashes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:39

Finding

Unpinned Remote Code and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–42
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-data-catalog
cd ai-intelligent-data-catalog
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone an externally controlled GitHub repository without pinning a reviewed commit, signed tag, or checksum. They then install dependencies from the remote repository's requirements.txt and execute its app.py.

Neither the referenced application nor its dependency manifest is included in the audited package. Consequently, the code ultimately installed and executed can differ from the code that existed when this skill was reviewed. No lockfile, package hashes, artifact signature, or other integrity control is specified.

The same sequence also creates dependency supply-chain exposure. Python package installation may execute package build or installation logic, and python app.py directly runs remote repository code. A compromise of the repository, its maintainer account, or one of its unpinned dependencies could therefore turn these documented commands into an arbitrary-code-execution path.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or a dependency resolved by requirements.txt.
2. The attacker modifies requirements.txt, a dependency package, or app.py to contain malicious behavior.
3. A user follows the instructions and clones the repository's current mutable state.
4. pip install -r requirements.txt installs the attacker-controlled dependency set and may execute package installation or build hooks.
5. python app.py executes the downloaded application code.
6. The payload operates with the privileges and environmental access of the user running the commands.

Impact Assessment

Successful exploitation ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application source and dependency manifests in the skill package so they can be audited together.
2. If external retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning a mutable default branch.
3. Distribute signed release artifacts and verify their signatures or cryptographic checksums before installation or execution.
4. Replace loosely resolved dependencies with a reviewed lockfile containing exact versions and hashes; install with hash verification, such as pip install --require-hashes.
5. Review transitive dependencies and obtain packages only from explicitly configured, trusted indexes.
6. Avoid directly executing newly downloaded code. Separate retrieval, integrity verification, review, installation, and execution into distinct steps.
7. Run installation and execution in an isolated, least-privileged environment without unnecessary credentials, host mounts, or network access.
8. Document the expected repository owner, commit identifier, artifact digest, supported dependency set, and verification procedure.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description and all user-facing documentation are presented exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is too generic to communicate the skill’s purpose, boundaries, or safe invocation conditions. In agent ecosystems, vague descriptions can cause inappropriate routing or unexpected invocation, increasing the chance the skill is used on unsuitable tasks or with sensitive data beyond its intended scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.