emergency circuit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:37 AM UTC
• Version: 1.0.0

Overview

The skill has a clear safety-monitoring purpose, but it asks users to install mutable external code and can stop agents automatically without enough operational safeguards.

Install only if you trust the external npm package or GitHub repository and can verify the exact version you are running. Test policies in sandbox or staging first, confirm agent IDs before using kill commands, and plan recovery for interrupted work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: readme.md:30

Finding

Unpinned External Package Installation Exposes Users to Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: readme.md:30-36, readme.md:113-119, skill.md:182-191, and skill.md:377-386
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippets

readme.md:30-36:

bash

# From ClawHub
clawhub install emergency-circuit

# From npm
npm install -g openclaw-emergency-circuit

The same installation instructions are repeated at readme.md:113-119.

skill.md:182-191:

bash

# From ClawHub
clawhub install emergency-circuit

# From npm
npm install -g openclaw-emergency-circuit

# From GitHub
git clone https://github.com/ZhenRobotics/openclaw-emergency-circuit.git

The same installation instructions are repeated at skill.md:377-386.

Technical Analysis

The audited artifact contains only documentation and does not include the implementation of the advertised monitoring, policy enforcement, anomaly detection, or emergency termination functionality. Instead, users are instructed to retrieve the implementation from mutable external package registries or a Git repository.

The npm command does not pin an exact package version or verify an integrity digest. Consequently, the code installed in the future may differ from the code that was available when this documentation was reviewed. npm packages may also define lifecycle scripts, such as preinstall, install, or postinstall, which can execute automatically during installation.

The -g option performs a global installation. Although this does not inherently grant administrative privileges, it broadens the installation scope and may cause users to run the command with elevated privileges on systems where the global package directory is not writable by the current user.

The Git clone instruction likewise does not pin a reviewed commit or tag. A repository owner compromise, malicious maintainer update, registry account takeover, ...[truncated 1955 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the implementation in the audited artifact or provide a reproducible, reviewable source archive.
2. Pin npm installation instructions to an exact reviewed version rather than resolving the latest mutable release.
3. Publish and verify cryptographic integrity information, package provenance, and signed release artifacts.
4. Pin Git installation instructions to a specific reviewed commit hash and verify signed tags or commits.
5. Prefer project-local installation over npm install -g to reduce installation scope.
6. Avoid elevated installation privileges and explicitly warn users not to use sudo unless it is strictly required and understood.
7. Use --ignore-scripts where compatible, or audit every npm lifecycle script before permitting it to execute.
8. Maintain a lockfile and dependency inventory, and continuously scan direct and transitive dependencies for known vulnerabilities and ownership changes.
9. Document the expected package publisher, repository owner, release checksum, and verification procedure so users can detect package substitution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes a destructive operational command, emergency-circuit kill --agent-id my-agent, but provides no warning about its impact, such as abrupt termination, possible interruption of active tasks, or need to verify the target agent before use. For markdown files, destructive behaviors that could affect system integrity should be accompanied by a user-facing warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents an emergency kill switch and automatic agent termination in production, but it does not prominently warn users about the operational risk of abrupt shutdowns such as interrupted workflows, partial state changes, or accidental denial of service. In a production safety-control skill, omission of this warning can lead operators to deploy aggressive policies without understanding disruption and recovery implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.