Ai Intelligent Api Management

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:03 AM UTC
• Version: 1.0.0

Overview

The skill describes an API management tool, but its install instructions run unpinned remote code and dependencies that are not included in the reviewed package.

Review this skill carefully before installing. Only run the GitHub clone, pip install, and app startup commands after you have inspected the referenced repository and dependencies, preferably pinned to a known commit and run in an isolated virtual environment or sandbox.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Unpinned Remote Repository and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–45
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

Vulnerable Code:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-api-management
cd ai-intelligent-api-management
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions direct users to clone a mutable remote Git repository and execute content that is not included in the audited artifact. The repository is not pinned to an immutable commit or signed release. No checksum or signature is provided to verify the downloaded source.

The subsequent pip install -r requirements.txt command installs dependencies from an unavailable and unreviewed requirements file. Python package installation can execute package build or installation logic. Finally, python app.py directly runs the remotely obtained application.

Consequently, the code ultimately executed by users can change after this skill has been reviewed. Neither the remote application nor its dependencies can be validated from the two files present in the audited project.

Attack Path

1. An attacker compromises the referenced repository, gains control of its publishing account, or causes a malicious dependency to be added to its requirements.txt.
2. The attacker modifies the default branch, application, or dependency definitions with malicious code.
3. A user follows the documented installation procedure and clones the current default branch.
4. pip install -r requirements.txt executes malicious package installation logic, or python app.py executes the modified application.
5. The payload runs with the permissions of the user performing the installation.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. Depending on that account's permissions and a ...[truncated 548 chars]

Remediation

View remediation

Remediation Suggestions

• Include the reviewed application source and dependency manifests directly in the skill package so that installed behavior matches the audited artifact.
• If remote retrieval is necessary, pin the repository to an immutable commit hash or a cryptographically signed release rather than cloning the mutable default branch.
• Publish trusted SHA-256 checksums or signatures and require verification before installation or execution.
• Use a dependency lockfile with exact versions and cryptographic hashes, such as a hash-locked requirements file generated through a trusted build process.
• Review direct and transitive dependencies for malicious, abandoned, typosquatted, or dependency-confusion packages.
• Install and run the application in an isolated virtual environment or sandbox using a non-privileged account.
• Avoid automatically executing downloaded code. Present the pinned source and dependency set for inspection before invoking installation or application commands.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and primary markdown headings/content present the skill in Chinese only, which can impose a language choice on users without opt-in. The policy allows locale constraints when they are explicitly justified, but this file does not state that the skill is intended only for Chinese-speaking or region-specific users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.