OpenClaw News Publisher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Markdown news publisher, but it needs review because it installs unpinned remote Node code and can publish through real platform credentials with limited safety guidance.

Install only after reviewing or pinning the referenced repository and its dependencies. Use dry-run and preview first, protect the .env file, prefer test or low-privilege platform accounts, and assume real publish commands can make article content and metadata public through connected services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:34

Finding

Unpinned Remote Repository Clone Followed by Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 34–39
Vulnerability Type: Unpinned remote source and dependency installation
Risk Level: Medium

Vulnerable code snippet:

bash

# Clone repository
git clone https://github.com/ZhenRobotics/openclaw-news-publisher.git
cd openclaw-news-publisher

# Install dependencies
npm install

Technical Analysis

The installation instructions clone the repository's mutable default branch without specifying a reviewed commit or signed release. They then execute npm install without requiring a lockfile, integrity verification, or lifecycle-script restrictions.

Consequently, the installed source and dependency graph can differ from the version reviewed during this audit. Moreover, npm install may automatically execute lifecycle scripts such as preinstall, install, and postinstall. If the remote repository, an npm maintainer account, or a transitive dependency is compromised, attacker-controlled code could execute during installation.

The audited artifact only contains skill.md and readme.md; it does not include the repository code, package manifest, or lockfile referenced by these instructions. Therefore, the safety of the remotely retrieved implementation and its dependencies cannot be verified from this artifact.

Attack Path

1. An attacker compromises the referenced GitHub repository, its default branch, a dependency maintainer, or the relevant package registry entry.
2. The attacker adds malicious application code or an npm lifecycle script to the remote source or dependency graph.
3. A user follows the documented installation procedure and clones the current, attacker-modified default branch.
4. The user runs npm install.
5. npm resolves the unverified dependency graph and may execute the malicious lifecycle script automatically.
6. The payload runs with the operating-system permissions of the user performing the installatio ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a specific reviewed commit hash or immutable, signed release tag rather than the mutable default branch.
2. Publish and commit a dependency lockfile, and use npm ci instead of npm install to enforce the reviewed dependency graph.
3. Require verification of release signatures, commit signatures, or published checksums before installation.
4. Pin direct and transitive dependency versions and retain npm integrity hashes in the lockfile.
5. Audit dependencies with tools such as npm audit, software composition analysis, and malware or provenance scanning before release.
6. Disable lifecycle scripts during initial dependency retrieval with npm ci --ignore-scripts, then explicitly review and run only required build scripts.
7. Document installation in an isolated, least-privileged environment without production credentials.
8. Include the actual implementation and dependency metadata in the reviewed skill package, or clearly disclose that remote code lies outside the audit boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 49)May include surrounding context.

md

npm install

# Configure platforms
cp .env.example .env
# Edit .env with your credentials

# Verify installation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 50)May include surrounding context.

md

npm install

# Configure platforms
cp .env.example .env
# Edit .env with your credentials

# Verify installation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README promotes one-click publication to multiple external platforms using linked accounts, but it does not warn users that article content, metadata, and account-associated activity will be transmitted to third-party services. In a publishing skill, that omission can mislead operators into using real credentials and distributing sensitive or unintended content without understanding the privacy and account-risk implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The configuration section instructs users to place platform API credentials in a .env file but does not emphasize secret handling, least-privilege account use, or the consequences of publishing through connected social/media accounts. This increases the risk of credential exposure, accidental live posting, and account misuse, especially because the tool is designed to automate outbound publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill repeatedly instructs users to publish content to RSS and external platforms, but it does not explicitly warn that article bodies, metadata, and potentially linked assets will be transmitted to third-party services and made public. In an agent skill context, this omission can cause unintended disclosure of sensitive or internal content because users may treat 'publish' as a local formatting step rather than an external distribution action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content of the README is effectively Chinese-only, including usage instructions and operational guidance. Under the stated policy, forcing a specific language without user opt-in or documented justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.