Ai Intelligent Chatbot Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:15 AM UTC
• Version: 1.0.2

Overview

This skill describes a chatbot builder, but installing it requires running code and dependencies from an unpinned external repository that was not included in the reviewed artifact.

Review this before installing. Only run it in an isolated virtual environment or sandbox, inspect the referenced repository and requirements first, and prefer a version pinned to a specific reviewed commit with verified dependencies. Do not run it with administrator privileges or in an environment containing sensitive credentials unless you trust the external repository.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:40

Finding

Unpinned Remote Repository Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–43
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-chatbot-builder
cd ai-intelligent-chatbot-builder
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone the current default branch of an external GitHub repository without pinning a reviewed commit or immutable release. They provide no checksum or signature verification before installing its dependencies and executing app.py.

As a result, the code ultimately executed is not contained in the audited artifact and can change after this review. The artifact provides no mechanism for users to verify that the retrieved implementation is the same version that was previously reviewed. This establishes an externally mutable code-execution channel.

The GitHub URL is explicit and uses HTTPS, and the reviewed file contains no evidence that the referenced repository is currently malicious. The finding concerns the insecure trust model and the resulting supply-chain exposure rather than confirmed malicious intent.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or the repository's release workflow.
2. The attacker modifies the default branch, requirements.txt, or app.py.
3. A user follows the documented installation commands without pinning or verifying the retrieved revision.
4. pip install -r requirements.txt may execute attacker-controlled package installation logic.
5. python app.py directly executes the attacker-controlled application code.
6. The payload operates with the permissions and environmental access of the user running these commands.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. De ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the repository to a specific reviewed commit hash or immutable, signed release rather than cloning the mutable default branch.
• Verify the downloaded source using a trusted cryptographic signature or a checksum distributed through an independent trusted channel.
• Vendor the reviewed implementation into the Skill package when feasible so that the audited and executed content are identical.
• Document the expected repository origin, revision, release signature, and verification procedure.
• Run installation and execution in an isolated environment with restricted filesystem, credential, and network access.
• Avoid running the application as an administrator or root user.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:40

Finding

Unverified Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–43
Vulnerability Type: Insecure dependencies
Risk Level: High

Complete Code Snippet:

bash

git clone https://github.com/openclaw-skills/ai-intelligent-chatbot-builder
cd ai-intelligent-chatbot-builder
pip install -r requirements.txt
python app.py

Technical Analysis

The instructions install dependencies from an externally retrieved requirements.txt without showing pinned versions, cryptographic hashes, a lockfile, or a trusted package index policy. Because that file is absent from the audited artifact, its package names, versions, sources, and integrity controls cannot be reviewed.

Python package installation can execute package build or installation logic. If the remote requirements are modified, resolve to compromised releases, or reference unsafe package sources, installation may execute malicious code before the application itself starts.

No specific malicious or typosquatted dependency is confirmed by the available evidence. The vulnerability is the unverified installation of an unseen and externally mutable dependency set.

Attack Path

1. An attacker compromises the external repository or a dependency that its requirements.txt resolves.
2. The requirements file is changed, or dependency resolution begins selecting an attacker-controlled release.
3. A user runs pip install -r requirements.txt.
4. Pip retrieves and installs the attacker-controlled package or package version.
5. Malicious build, installation, import, or runtime code executes with the invoking user's permissions.
6. Subsequent execution of app.py can trigger additional malicious dependency behavior.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing user's account. Accessible source files, local configuration, environment variables, package credentials, and other user-readable data may be exposed or ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

• Include an audited lockfile containing exact dependency versions.
• Require hashes for all packages, such as with pip's --require-hashes mode and a fully hashed requirements file.
• Restrict package resolution to approved indexes and prohibit unexpected direct URLs or alternate indexes.
• Review all direct and transitive dependencies for provenance, known vulnerabilities, and suspicious package names.
• Generate and publish a software bill of materials for each release.
• Use a virtual environment or sandbox with minimal permissions and no unnecessary credentials.
• Re-audit dependencies whenever the lockfile or pinned application revision changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and title are entirely presented in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because the skill appears to impose a language choice by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.