Ai Intelligent Employee Onboarding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

The skill describes a plausible HR onboarding tool, but it asks users to run unreviewed mutable remote code for sensitive employee workflows without clear safeguards.

Review this carefully before installing. Use an isolated environment, inspect the referenced GitHub repository and dependencies yourself, pin to a known commit, and do not connect it to HR, device-provisioning, training, benefits, or notification systems until data handling, approvals, and rollback procedures are clear.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:40

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–43
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-employee-onboarding
cd ai-intelligent-employee-onboarding
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions retrieve a mutable external Git repository without pinning it to a reviewed commit or immutable release. They subsequently install dependencies from the retrieved requirements.txt and execute the retrieved app.py.

The remote source code and dependency manifest are not included in the audited artifact, which contains only SKILL.md and skill.json. Consequently, the effective payload cannot be verified during this audit and may change after publication or review. Both Python package installation hooks and app.py can execute arbitrary code with the privileges of the user following these instructions.

Package provenance is also unclear because skill.json identifies the author as yang1002378395-cmyk, while SKILL.md attributes the project to “OpenClaw Skills Team.” This discrepancy does not independently prove malicious behavior, but it limits confidence in the external repository's ownership.

Attack Path

1. An attacker compromises the referenced repository, gains control of its publishing account, or otherwise causes malicious content to be added to its default branch.
2. The attacker modifies app.py, requirements.txt, or a referenced dependency to include an arbitrary payload.
3. A user follows the documented installation procedure and clones the current default branch without an immutable revision pin.
4. pip install -r requirements.txt may execute malicious package installation or build hooks.
5. python app.py directly executes the remotely controlled application payload.
6. The payload operates with the invoking user ...[truncated 687 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete, auditable application source and dependency manifests directly in the Skill package.
2. If external retrieval is unavoidable, pin the repository to a reviewed full commit SHA rather than cloning a mutable default branch.
3. Verify downloaded content using cryptographic hashes or signed releases before installation or execution.
4. Pin every Python dependency to an exact reviewed version and require package hashes, such as through pip install --require-hashes.
5. Generate and review a software bill of materials and use automated dependency vulnerability scanning.
6. Publish verifiable repository ownership and reconcile the author discrepancy between skill.json and SKILL.md.
7. Execute installation and startup in a least-privileged, isolated environment without unnecessary credentials, sensitive mounts, or host access.
8. Replace direct execution instructions with a reproducible build process based on immutable, reviewed artifacts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes collecting employee information and triggering automated onboarding actions such as device requests, training scheduling, and gift distribution, but it provides no warning about handling sensitive personal data, approval requirements, or the consequences of automation. In an HR context, missing disclosure and safeguards can lead to over-collection, unauthorized actions, privacy violations, or accidental provisioning based on incomplete or incorrect inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and user-facing documentation are entirely in Chinese, with no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment. This can violate language/locale policy where users should be given a choice or the restriction should be explicitly justified.

Content

No source excerpt is available for this finding.