Security audit

openclaw intent router

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but users are directed to install mutable external npm code, including a global CLI, that is not included in the reviewed artifact.

Install only after reviewing the npm package and repository source, pinning an exact version, and avoiding global installation unless needed. Use confirmation checks around any handler that sends messages, changes accounts, spends money, posts publicly, or modifies important data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: skill.md:157
Finding: Unpinned and Unreviewable Third-Party npm Package Installation## Vulnerability Details **File Location**: `skill.md:157-177`; repeated in `readme.md:63`, `readme.md:240`, and `readme.md:266` **Vulnerability Type**: Unpinned third-party dependency and unsafe package execution **Risk Level**: Medium ### Vulnerable Code ```bash # Install from npm registry npm install openclaw-intent-router # Verify installation node -e "console.log(require('openclaw-intent-router'))" ``` The documentation also recommends a global installation: ```bash # Install CLI globally npm install -g openclaw-intent-router ``` ### Technical Analysis The instructions install `openclaw-intent-router` without pinning an exact version or verifying a package integrity digest. The audited project contains only `skill.md` and `readme.md`; it does not include the referenced package's source code, `package.json`, lockfile, checksums, or a vendored release. Consequently, the code ultimately installed and executed cannot be verified from this artifact. An npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. The subsequent `require('openclaw-intent-router')` command also executes the package's module initialization code. Because registry resolution is mutable, the effective code may differ from the content originally reviewed. Global installation can additionally expose a malicious or compromised CLI executable through the user's command search path. This finding does not establish that the referenced package is currently malicious. It identifies a supply-chain boundary that the submitted artifact does not secure or make auditable. ### Attack Path 1. A user follows the documented installation instructions. 2. npm resolves the latest package version allowed by the registry because no exact version is specified. 3. An attacker compromises the publisher account, registry package, or another component in the package's dependency chain. 4. npm downloads the al ...[truncated 1207 chars]
Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version rather than relying on mutable registry resolution: ```bash npm install --save-exact openclaw-intent-router@1.0.0 ``` 2. Publish and verify the expected npm integrity digest before installation. 3. Include a lockfile and retain its integrity metadata in the audited artifact. 4. Bundle or vendor the relevant source code so package behavior can be reviewed with the skill. 5. Initially inspect the package without running lifecycle scripts: ```bash npm install --ignore-scripts --save-exact openclaw-intent-router@1.0.0 ``` 6. Review package contents, lifecycle scripts, dependency trees, publisher provenance, and release signatures before enabling scripts or importing the module. 7. Avoid global installation unless operationally necessary. If a CLI is required, run a pinned version in an isolated, least-privileged environment. 8. Perform installation as an unprivileged user and never use administrator or root privileges solely to install this package. 9. Update the documentation to perform verification before installation rather than relying only on `npm audit` after package code may already have executed.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Exfiltration Commands

High

Category: Prompt Injection
Content: ### What This Package Does NOT Do / 此包不会做的事 **English:** - ❌ Does not send data to external servers - ❌ Does not require API keys or credentials - ❌ Does not collect telemetry - ❌ Does not execute arbitrary code from user input
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The README advertises the skill for 'Workflow Automation - Natural language triggers' without defining what kinds of phrases should or should not activate downstream skills. Because this is a markdown file and the description is broad, it risks encouraging overly permissive trigger design that could overlap with ordinary user speech.

External Transmission

Medium

Category: Data Exfiltration
Content: ### What This Package Does NOT Do / 此包不会做的事 **English:** - ❌ Does not send data to external servers - ❌ Does not require API keys or credentials - ❌ Does not collect telemetry - ❌ Does not execute arbitrary code from user input
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: - ❌ Does not send data to external servers - ❌ Does not require API keys or credentials - ❌ Does not collect telemetry - ❌ Does not execute arbitrary code from user input - ❌ Does not access sensitive system resources **中文：**
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Vague Triggers

Low

Confidence: 73% confidence
Finding: The architecture states 'User Intent → Intent Analyzer → Skill Matcher → Skill Execution' in a way that suggests any user intent may be routed directly to execution, but it does not describe boundaries, filtering, or when routing should not occur. In markdown documentation, this can be an ambiguous activation model that lacks specificity on trigger constraints.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The file is bilingual throughout, but it does not state whether the skill will operate in English, Chinese, or both, nor whether users can choose their preferred language. For organizations with language or locale policies, presenting a fixed bilingual interface without explicit opt-in or selection guidance can be a policy concern.

Static analysis

No suspicious patterns detected.