Security audit

Ai Intelligent Access Control

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a legitimate access-control product, but its install steps execute unreviewed remote code and dependencies for a sensitive biometric and physical-access use case.

Review this carefully before installing. Only run it if you trust the remote repository at install time, can pin and verify a reviewed commit, and can install it in an isolated least-privileged environment. For real access-control deployment, require clear policies for biometric data, ID/card data, access logs, consent, retention, encryption, administrator access, and incident response.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:43
Finding: Unpinned Remote Code Retrieval and Execution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 43–46
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
git clone https://github.com/openclaw-skills/ai-intelligent-access-control cd ai-intelligent-access-control pip install -r requirements.txt python app.py

Technical Analysis

The installation instructions clone a mutable remote repository without pinning a reviewed commit, tag, or signed release and without verifying its integrity. They then install dependencies from a remotely obtained requirements.txt and execute a remotely obtained app.py.

Neither the referenced application files nor its dependency manifest are present in the audited artifact. The effective payload can therefore change after this Skill has been reviewed. A compromise or malicious modification of the repository's default branch could cause users following these instructions to execute arbitrary code.

Attack Path

An attacker compromises the referenced repository, gains authority to modify it, or otherwise causes malicious content to be served from its mutable default branch.

The attacker modifies requirements.txt, a dependency, or app.py.

A user follows the documented commands and clones the modified repository.

pip install -r requirements.txt executes dependency installation behavior, or python app.py directly executes the modified application.

The malicious payload operates with the privileges and environmental access of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on that user's permissions and environment, the payload could access or modify local files, credentials, application data, processes, and network-accessible resources. Given the advertised biometric and physical access-control purpose, a compromised implementation could also expose sensit ...[truncated 127 chars]
Remediation: View remediation
Remediation Suggestions

Include the executable source code and dependency manifests in the reviewed Skill package.

Pin the remote source to an immutable, reviewed commit hash or a cryptographically signed release rather than a mutable default branch.

Verify release signatures or trusted cryptographic checksums before installation or execution.

Document the expected repository identity and commit digest so users can independently validate the retrieved content.

Execute the application under a dedicated least-privileged account and within an isolated environment.

Require a new security review whenever the pinned source revision changes.

T08 · Insecure Dependencies

Error

Location: SKILL.md:45
Finding: Unverified and Unpinned Third-Party Dependency Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 45
Vulnerability Type: Insecure dependency installation
Risk Level: High

bash
pip install -r requirements.txt

Technical Analysis

The Skill instructs users to install dependencies from a requirements.txt retrieved from an external, mutable repository. That manifest is absent from the audited project, so its package names, versions, sources, hashes, and installation behavior cannot be inspected.

The command does not enforce hash verification through --require-hashes. If dependency versions are unpinned, resolved artifacts can also change between installations. Python package installation may execute attacker-controlled build or installation code, making an unsafe or compromised dependency a code-execution vector.

Attack Path

An attacker modifies the remote dependency manifest, compromises one of its dependencies, or influences resolution of an insufficiently constrained package.

A user retrieves the external repository and runs the documented installation command.

pip downloads the attacker-controlled or compromised package.

Malicious build or installation logic executes during installation, or malicious package code executes when imported by the application.

The payload gains the privileges and access available to the user running pip or the application.

Impact Assessment

Exploitation could result in arbitrary code execution during dependency installation or application startup. The resulting access may include the invoking user's files, credentials, environment variables, network access, and application data. Installation under an administrative account or outside an isolated environment would increase the affected scope.
Remediation: View remediation
Remediation Suggestions

Package a reviewed dependency manifest with the Skill rather than relying on an unaudited remote file.

Pin every direct and transitive dependency to an approved version.

Record cryptographic hashes for all artifacts and install with pip install --require-hashes -r requirements.txt.

Use a controlled package index or an internally mirrored and vetted artifact repository.

Scan dependencies for known vulnerabilities, suspicious ownership changes, typosquatting, and unexpected build scripts.

Install dependencies in a dedicated virtual environment or restricted container under a non-privileged account.

Regenerate and review the lock file through a controlled process whenever dependencies change.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes facial recognition, card/ID handling, permission control, and access records, but provides no warning that biometric data and entry logs are sensitive personal data. In an access-control context, this omission can lead operators to deploy or use the skill without understanding privacy, consent, retention, and compliance obligations, increasing the risk of misuse or unlawful processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The visible natural-language description and instructions are entirely in Chinese, but the file does not state that the skill is intended only for Chinese-speaking users or offer an alternative language. This can violate language/locale policy when a specific language is effectively forced without user opt-in or justification.
Content: No source excerpt is available for this finding.