Security audit

decentral social

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly coherent, but it asks users to execute an unpinned npm package and underexplains privacy boundaries for networked social features.

Review the npm package and source before installing, prefer an exact pinned version with reproducible integrity metadata, and run demos in an isolated environment. Treat federation, DMs, public posting, and autonomous social behavior as network-enabled features that may expose content or metadata unless the package clearly documents and lets you control those flows.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:49
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation
``` 2. Publish and retain a lockfile containing registry integrity metadata, and require installation with a lockfile-enforcing workflow such as `npm ci`. 3. Avoid download-and-execute behavior through an unpinned `npx` invocation. Install the verified dependency first and invoke its local binary: ```bash npm exec --no -- ods demo ``` The exact invocation should be validated against the selected npm version and package binary name. 4. Where package functionality permits, initially install with lifecycle scripts disabled: ```bash npm install --ignore-scripts openclaw-decentral-social@ ``` 5. Include or link to the exact audited source revision, dependency manifest, lockfile, checksums, and reproducible-build information so reviewers can verify that the installed artifact corresponds to the reviewed code. 6. Run demonstrations in a least-privileged, isolated environment without production credentials or sensitive files, and restrict outbound network access when networking is not required. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill promotes direct agent-to-agent communication, federation, DMs, and protocol support, while the security section strongly emphasizes local-first behavior and 'no external API calls (by default)'. Without an explicit warning that optional networking and federation features may transmit prompts, messages, metadata, or identifiers to other agents or external protocols, users may unknowingly expose sensitive data or enable unintended outbound communications.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documentation instructs users to run npx openclaw-decentral-social without pinning an exact version, which allows whatever package version is current at execution time to run. If the npm package is later compromised, typosquatted, or updated with malicious code, users may execute unreviewed code directly on their systems.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This is a second instance of the same risky pattern: invoking an npm package with npx and no pinned version. Because npx fetches and executes the latest matching package by default, users are exposed to supply-chain risk and arbitrary code execution if the published package changes or is hijacked.
Content: No source excerpt is available for this finding.