Ai Intelligent After Sales Service

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.0.3

Overview

The skill describes a plausible after-sales service app, but its install steps run unreviewed remote code and the documentation under-explains customer data handling.

Review the remote GitHub source and dependencies before installing, pin the source to a known commit, and run it in an isolated least-privilege environment. Treat it as software that may process customer contact details, service history, survey responses, and business data, so confirm consent, opt-out, retention, and access-control practices before deployment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-45
Vulnerability Type: Remote code retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-after-sales-service
cd ai-intelligent-after-sales-service
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone a mutable remote repository without pinning a reviewed commit or verifying its integrity. They then install packages from a remotely supplied requirements.txt and execute the remotely supplied app.py.

Neither requirements.txt nor app.py is included in the audited artifact, which contains only SKILL.md. Consequently, the effective application payload and its dependency graph cannot be inspected or verified during this audit. The payload may change after the skill has been reviewed, while the instructions continue to retrieve and execute the latest remote version.

Although dependency installation is also part of the exposure, the best matching classification is T03: Remote Payload Retrieval and Execution because the primary issue is the direct retrieval and execution of mutable external application code. There is no local evidence proving that the current remote repository is malicious.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or the repository's mutable default branch.
2. The attacker modifies app.py, requirements.txt, or another imported application component.
3. A user follows the documented installation commands and clones the attacker-controlled revision.
4. pip install -r requirements.txt may execute package build or installation logic supplied through the modified dependency manifest.
5. python app.py directly executes the retrieved application payload.
6. The payload runs with the privileges and environmental access of the user ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application source and dependency manifests in the skill package so they can be reviewed together.
2. Pin the remote source to a specific, reviewed commit hash rather than cloning a mutable default branch.
3. Verify the downloaded source using a trusted cryptographic signature or a securely distributed checksum.
4. Pin every Python dependency to an exact version and require cryptographic hashes, for example with pip install --require-hashes.
5. Use a trusted package index and review transitive dependencies, package provenance, and installation scripts.
6. Install and run the application in an isolated, least-privileged virtual environment or container with restricted filesystem, credential, and network access.
7. Separate retrieval from execution and require an explicit source review or integrity-validation step before installing dependencies or launching the application.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly advertises automated customer satisfaction surveys and feedback collection, but the documentation provides no warning about contacting customers, handling personal data, consent, retention, or opt-out controls. In an after-sales context this can lead to privacy violations, unauthorized outreach, and non-compliant processing of customer data because operators may deploy it without understanding those obligations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language instructions and descriptions are entirely in Chinese, and the file does not indicate that the skill is China-specific or that users can choose another language. Per the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.