Ai Intelligent Asset Management

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:04 AM UTC
• Version: 1.0.0

Overview

The skill is a simple IT asset-management installer, but it asks users to run mutable, unaudited remote code and dependencies from GitHub.

Install only if you are comfortable auditing or trusting the referenced GitHub repository and its Python dependencies. Prefer a pinned commit, locked dependency versions with hashes, and an isolated environment without sensitive credentials before running the app.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:44

Finding

Execution of Unreviewed Remote Code and Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-47
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Suspicious

Vulnerable Code:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-asset-management
cd ai-intelligent-asset-management
pip install -r requirements.txt
python app.py

Technical Analysis

The supplied skill artifact contains no application implementation or dependency manifest. Instead, its installation instructions direct users to clone a remote repository, install packages from an unreviewed requirements.txt, and execute an unreviewed app.py.

Because neither the remote source revision nor the dependencies are pinned and included in the audited artifact, the effective code executed by users can differ from the content reviewed here. The remote repository could change after publication, and dependency installation may execute package build or installation hooks. A compromise of the repository, its owner account, or one of its dependencies could therefore introduce arbitrary code into this workflow.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or a dependency resolved by its requirements.txt.
2. The attacker inserts malicious application code, dependency declarations, or package installation hooks.
3. A user follows the documented installation procedure and clones the mutable remote repository.
4. pip install -r requirements.txt installs the attacker-controlled dependency content and may execute malicious installation hooks.
5. The user runs python app.py, directly executing the unreviewed remote application.
6. The payload operates with the privileges and environmental access of the user who ran the commands.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the invoking user's privileges. Depending on that user's permissions and environment, th ...[truncated 350 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete application source and dependency manifests in the skill package so they can be audited together.
2. Pin the remote repository to a reviewed, immutable commit rather than cloning the default branch.
3. Pin every Python dependency to an exact version and use a lockfile.
4. Require package hashes, such as through pip install --require-hashes, to detect substituted artifacts.
5. Verify repository commits and release artifacts using trusted signatures or documented checksums.
6. Review all direct and transitive dependencies for provenance, known vulnerabilities, and unexpected installation hooks.
7. Run installation and application startup in an isolated, least-privileged environment without unnecessary credentials or host access.
8. Ensure the audited commit, dependency lockfile, and integrity metadata are updated and reviewed together for every release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and main markdown content are written in Chinese, and the file does not indicate that the skill is region-specific or provide any user opt-in for language preference. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.