junior-high-math-research-plans

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:06 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a Chinese junior-high math teaching resource, but it asks for unnecessary command-execution permission and recommends an unpinned global CLI install.

Review this before installing because the teaching content itself looks purpose-aligned, but the package should not need exec permission. Prefer a version-pinned, trusted install path and remove or deny command-execution access unless a future version clearly explains why it is required.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Global CLI Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:10
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

bash

npm install -g clawdhub

Technical Analysis

The installation instructions direct users to install the latest available version of the clawdhub npm package globally. The command does not specify an exact reviewed version, lock an integrity hash, or disable npm lifecycle scripts.

npm packages can define lifecycle hooks such as preinstall, install, and postinstall. These hooks may execute automatically during installation. Because the package version is uncontrolled, a future compromised or malicious release could execute code that was not present when this Skill was audited.

Global installation increases the potential scope because it modifies the user's global npm environment and may expose a command on the system path. The audited project itself does not contain evidence that the named dependency is malicious; the risk arises from trusting an unpinned future package release.

Attack Path

1. An attacker compromises the publisher account, package repository, or release process for the referenced npm package.
2. The attacker publishes a malicious package version containing an npm lifecycle script or modified CLI implementation.
3. A user follows the README and runs npm install -g clawdhub.
4. npm retrieves the current uncontrolled release.
5. A malicious lifecycle script executes with the privileges of the installing user, or the installed CLI executes malicious behavior when subsequently invoked.
6. The attacker may access files available to that user, modify the user's development environment, or install additional payloads.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Potential scope includes user-accessible files, npm configuration and tokens, developme ...[truncated 292 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact version that has been reviewed:

   bash

   npm install -g clawdhub@<reviewed-exact-version>
   

2. Verify that the package name and publisher correspond to the official distribution before recommending installation.
3. Publish expected package integrity information or signed release details through a trusted channel.
4. Prefer a project-local development dependency over a global installation, then invoke it through a locked package manager workflow.
5. Commit and enforce a lockfile where applicable.
6. Document whether the package uses lifecycle scripts and consider installation with lifecycle scripts disabled when they are unnecessary.
7. Periodically re-audit the pinned version before updating the documented command.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: package.json:43

Finding

Skill Manifest Requests Unnecessary Command-Execution Permission

Content

View full analysis

Vulnerability Details

File Location: package.json:43
Vulnerability Type: Excessive runtime permission
Risk Level: Low

json

"permissions": ["read", "write", "exec"]

Technical Analysis

The OpenClaw manifest requests exec permission even though the reviewed implementation does not use child_process, shell commands, subprocess spawning, dynamic evaluation, or another command-execution sink.

The resource finder only reads fixed Markdown indexes bundled with the package. Teaching-plan generation performs local string templating. The publishing utility writes a report and changelog to fixed paths inside the package. Consequently, command execution is not required for the documented implementation.

Granting an unused high-impact capability violates least privilege. It increases the consequences of a future malicious update, dependency compromise, or subsequently introduced code-injection flaw because the Skill may already be authorized to execute local commands.

No current code path in the audited package was found that directly exercises this permission, so this is a permission-boundary weakness rather than evidence of active command execution.

Attack Path

1. A user installs or enables the Skill with the permissions declared in its manifest.
2. The platform grants the unnecessary exec capability.
3. A later malicious update, compromised component, or newly introduced exploitable code path reaches the Skill.
4. The altered code invokes the already-authorized execution capability.
5. Commands run under the operating-system identity of the Agent or OpenClaw service without requiring the user to approve a newly requested permission.

Impact Assessment

If the platform enforces this manifest as an authorization boundary, misuse of exec could allow arbitrary command execution with the privileges of the OpenClaw process. This could expose files, environment variables, application credent ...[truncated 242 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the permission declaration:

   json

   "permissions": ["read", "write"]
   

2. Determine whether the normal Skill runtime needs write. Resource searching and teaching-plan generation appear to require only read access and in-memory processing.
3. Separate the publishing utility from normal runtime operation. Grant write access only when the user explicitly invokes release preparation.
4. Use the narrowest supported filesystem scope, limiting reads to bundled resource and template directories and writes to explicitly approved output files.
5. Add a release-time permission review that rejects capabilities not referenced by implementation code.
6. Require explicit user approval if command execution is added in a future release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The line '使用中文注释和文档' imposes a specific language requirement in natural-language project policy. Under the stated policy rules, forcing a language without opt-in or documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all user-facing instructions and examples only in Chinese, which effectively forces a specific language on users without opt-in. The policy allows locale constraints only when they are optional or clearly justified as region-specific, neither of which is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package description is written entirely in Chinese and specifically targets Chinese curriculum content ('人教版2024新版教材') without any indication that the skill supports other languages or lets the user opt into this locale. Under the policy, locale-specific behavior should either offer a choice or be clearly documented as a justified region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire template is written in Chinese and structurally assumes Chinese-language output for headings, labels, and instructional content. Under the policy rule for language/locale, this is a violation because it imposes a specific language without any documented user opt-in or alternative locale choice.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: openclaw has 16 known advisory(ies) (CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest declares a broad, unpinned dependency range for openclaw (>=1.0.0) even though the package is reported to have multiple known advisories. Because installation may resolve to vulnerable releases, consumers cannot verify they are getting a patched version, and the declared skill permissions include exec, which can amplify the impact of a compromised or vulnerable runtime dependency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere does it mention that the language is optional or intended only for a Chinese-speaking audience. Under the policy, a skill that forces a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code formats dates using the fixed locale 'zh-CN', which enforces a specific language/locale behavior. The policy requires flagging locale constraints when they are forced without user opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The returned template is entirely Chinese-language instructional content, so the skill effectively forces Chinese output. There is no indication in the file that users can choose another language or that the locale restriction is intentionally documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This chapter-plan template is also fully hard-coded in Chinese, continuing the same forced-language behavior. Because no opt-in or documented justification appears in the file, this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The semester-plan template is fully Chinese and includes fixed Chinese locale conventions, again without any user choice. This creates a repeated language policy violation across the skill's main outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.