OpenClaw GitHub Copilot

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:08 AM UTC
• Version: 1.0.0

Overview

This skill transparently helps configure GitHub Copilot as the OpenClaw default model, with no evidence of hidden data access, exfiltration, or unsafe automatic execution.

Before installing, confirm you are comfortable letting the skill install or use the OpenClaw CLI and change your OpenClaw default model to GitHub Copilot when you run the activation flow. Prefer installing OpenClaw from a trusted source and review the exact model and alias changes before using --activate or --ensure-alias.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Node.js Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"🐙","homepage":"https://docs.openclaw.ai/cli/models","requires":{"bins":["openclaw"]},"install":[{"id":"node","kind":"node","package":"openclaw","bins":["openclaw"],"label":"Install OpenClaw CLI"}]}}

Technical Analysis

The installation metadata declares the openclaw Node.js package without an exact version or integrity constraint. Consequently, installation may resolve to a package release that was published after this Skill was reviewed.

The installed package provides the openclaw executable invoked by all three helper scripts. If the package source, maintainer account, registry resolution, or a future release is compromised, attacker-controlled code could run during package installation or whenever the executable is invoked. This creates a supply-chain trust gap between the reviewed Skill and its effective runtime dependency.

The audited scripts do not themselves download remote payloads or contain malicious code; the risk arises from unconstrained dependency resolution.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or a future release of the openclaw package.
2. The attacker publishes a malicious package version under the expected package name.
3. The Skill installer resolves and installs that version because no reviewed version or integrity digest is specified.
4. Malicious code executes through installation lifecycle behavior or when the Skill invokes the installed openclaw binary.
5. The payload operates with the permissions of the user running the installation or Skill commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user’s privileges. Depending on that account’s access, an attacker could read accessible files ...[truncated 341 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openclaw to an exact, reviewed version rather than allowing unconstrained registry resolution.
2. Add a package integrity digest or lockfile verification where the Skill packaging and installation mechanism supports it.
3. Configure installation to use an explicitly trusted registry and verify the package publisher and provenance.
4. Disable or restrict dependency lifecycle scripts where feasible.
5. Require explicit user approval before installing or upgrading the executable dependency.
6. Review and test each dependency update before changing the pinned version.
7. Document the expected package source, publisher, version, and verification procedure so users can independently validate the dependency.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language examples for invocation and response are exclusively in Chinese, including the recommended trigger phrases and the sample user-facing reply. Because the skill does not state that it is intended only for Chinese-speaking users or offer an opt-in language choice, this creates a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section 'Suggested wording for end users' provides only Chinese-language phrasing, which implies a fixed language choice for user-facing communication. The file does not offer an alternative language option or explain a justified locale-specific requirement, so this conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.