Ai Intelligent Live Chat

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

The skill describes a plausible AI live-chat app, but its install steps run unreviewed code from a mutable remote GitHub repository.

Review this skill carefully before installing. Only run the GitHub install commands in an isolated environment after verifying the repository source, pinning a reviewed commit, checking dependencies, and deciding how customer chat logs and GPT-bound data will be protected.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:43

Finding

Mutable Remote Repository Is Retrieved and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–46
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-live-chat
cd ai-intelligent-live-chat
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions retrieve a mutable remote repository without pinning it to a reviewed commit, signed tag, or integrity hash. They then install dependencies from the repository's unseen requirements.txt and execute its unseen app.py.

Consequently, the code ultimately executed can differ from the content present when this skill package was audited. The supplied artifact contains only documentation and metadata, so the remote application's source, dependency versions, package installation hooks, and runtime behavior cannot be verified locally. Dependency installation may itself execute package build or installation logic before app.py is launched.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or an upstream dependency.
2. The attacker adds a malicious dependency, installation hook, or application payload to the repository.
3. A user follows the documented git clone command, receiving the attacker's current repository content.
4. pip install -r requirements.txt installs the unverified dependencies and may execute malicious build or installation code.
5. python app.py executes the unverified application payload.
6. The payload operates with the permissions and environment access of the user who ran the commands.

Impact Assessment

Successful exploitation can result in arbitrary code execution under the invoking user's account. The effective scope can include reading or modifying files accessible to that account, accessing environment variables and locally available credentials, making network connections, and altering ...[truncated 405 chars]

Remediation

View remediation

Remediation Suggestions

• Include the complete, auditable implementation within the skill package rather than directing users to execute mutable remote content.
• If remote retrieval is necessary, pin the repository to a specific reviewed commit and verify the downloaded content against a trusted cryptographic hash.
• Use signed releases or signed commits and document the signature-verification procedure.
• Pin every Python dependency to an exact version and use a lock file containing integrity hashes, such as a hash-locked requirements file.
• Review dependencies for package-name confusion, compromised maintainers, unsafe source distributions, and installation hooks.
• Separate retrieval, dependency installation, and execution into explicit steps so users can inspect the content before running it.
• Execute the application in a least-privileged, isolated environment with restricted filesystem access, credentials, environment variables, and outbound network connectivity.
• Ensure future releases place the reviewed source and dependency manifest under the same versioned artifact covered by the security audit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly advertises chat history retention and GPT integration, which implies user conversations may be stored and transmitted to an AI provider, yet the documentation provides no notice about data collection, retention, sharing, or privacy boundaries. In a customer-support context, users commonly disclose personal, account, or sensitive business information, so the omission increases the risk of unsafe deployment and accidental privacy violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language content of the skill file is entirely in Chinese, which can impose a language constraint on users without explicit opt-in. The file does not state that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description "AI intelligent ai-intelligent-live-chat" is generic and does not indicate when the skill should be invoked versus when it should not. For manifest files, missing specificity about scope or constraints can lead to unintended activation because there are no domain boundaries or exclusion conditions described.

Content

No source excerpt is available for this finding.