Ai Intelligent Agriculture Monitoring

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:24 AM UTC
• Version: 1.0.3

Overview

The skill describes an agriculture monitoring app, but its only installation path runs unreviewed code from a mutable remote repository.

Only install this if you are prepared to review the remote GitHub repository and its dependencies yourself. Prefer a pinned commit or signed release, use a virtual environment or sandbox, avoid running as root, and do not give it access to farm devices, credentials, or sensitive data until the actual application code has been audited.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:43

Finding

Unpinned Remote Repository Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-46
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/openclaw-skills/ai-intelligent-agriculture-monitoring
cd ai-intelligent-agriculture-monitoring
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone a remote repository's mutable default branch without pinning it to a reviewed commit or signed release. They subsequently install packages from an unavailable and unverified requirements.txt file and execute the downloaded app.py.

The audited package contains only SKILL.md; neither the application source nor the dependency manifest is included locally. Consequently, the effective executable payload is controlled by remote content and may change after this skill has been reviewed. An attacker who compromises the repository, its maintainer account, or its delivery path could substitute arbitrary Python code. Additionally, Python package installation may execute attacker-controlled build hooks before app.py is launched.

Attack Path

1. An attacker compromises the remote repository, a maintainer account, or one of the dependencies referenced by its mutable dependency manifest.
2. The attacker modifies the default branch, requirements.txt, dependency metadata, or app.py.
3. A user follows the documented commands and clones the attacker-controlled revision.
4. pip install -r requirements.txt downloads dependencies and may execute malicious package build or installation logic.
5. python app.py directly executes the remotely supplied application payload.
6. The payload operates with the permissions and environmental access of the user who ran the commands.

Impact Assessment

Successful exploitation can result in arbitrary code execution under the invoking user's account. The payload could ac ...[truncated 465 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application source and dependency manifest in the reviewed package so its behavior can be audited.
2. Pin the remote source to a specific, reviewed commit hash or cryptographically signed release rather than cloning a mutable default branch.
3. Verify release signatures or published checksums before installing or executing downloaded content.
4. Pin every Python dependency to an exact reviewed version and require hashes, for example by using pip install --require-hashes -r requirements.txt.
5. Generate and retain a dependency lock file, review transitive dependencies, and continuously scan them for compromise and known vulnerabilities.
6. Install dependencies inside a dedicated, unprivileged virtual environment or sandbox with restricted filesystem, credential, device, and network access.
7. Review downloaded source and dependency metadata before running installation hooks or launching app.py.
8. Avoid running the installation or application as root or another privileged account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and main markdown content present the skill in Chinese only, which can impose a specific language on users without offering an alternative or opt-in. The policy for this audit flags language or locale constraints when they are forced and not documented as optional or region-specific.

Content

No source excerpt is available for this finding.