openclaw intent router

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but users are directed to install mutable external npm code, including a global CLI, that is not included in the reviewed artifact.

Install only after reviewing the npm package and repository source, pinning an exact version, and avoiding global installation unless needed. Use confirmation checks around any handler that sends messages, changes accounts, spends money, posts publicly, or modifies important data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:157

Finding

Unpinned and Unreviewable Third-Party npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md:157-177; repeated in readme.md:63, readme.md:240, and readme.md:266
Vulnerability Type: Unpinned third-party dependency and unsafe package execution
Risk Level: Medium

Vulnerable Code

bash

# Install from npm registry
npm install openclaw-intent-router

# Verify installation
node -e "console.log(require('openclaw-intent-router'))"

The documentation also recommends a global installation:

bash

# Install CLI globally
npm install -g openclaw-intent-router

Technical Analysis

The instructions install openclaw-intent-router without pinning an exact version or verifying a package integrity digest. The audited project contains only skill.md and readme.md; it does not include the referenced package's source code, package.json, lockfile, checksums, or a vendored release. Consequently, the code ultimately installed and executed cannot be verified from this artifact.

An npm installation can execute package lifecycle scripts such as preinstall, install, and postinstall. The subsequent require('openclaw-intent-router') command also executes the package's module initialization code. Because registry resolution is mutable, the effective code may differ from the content originally reviewed. Global installation can additionally expose a malicious or compromised CLI executable through the user's command search path.

This finding does not establish that the referenced package is currently malicious. It identifies a supply-chain boundary that the submitted artifact does not secure or make auditable.

Attack Path

1. A user follows the documented installation instructions.
2. npm resolves the latest package version allowed by the registry because no exact version is specified.
3. An attacker compromises the publisher account, registry package, or another component in the package's dependency chain.
4. npm downloads the al ...[truncated 1207 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than relying on mutable registry resolution:

   bash

   npm install --save-exact openclaw-intent-router@1.0.0
   

2. Publish and verify the expected npm integrity digest before installation.
3. Include a lockfile and retain its integrity metadata in the audited artifact.
4. Bundle or vendor the relevant source code so package behavior can be reviewed with the skill.
5. Initially inspect the package without running lifecycle scripts:

   bash

   npm install --ignore-scripts --save-exact openclaw-intent-router@1.0.0
   

6. Review package contents, lifecycle scripts, dependency trees, publisher provenance, and release signatures before enabling scripts or importing the module.
7. Avoid global installation unless operationally necessary. If a CLI is required, run a pinned version in an isolated, least-privileged environment.
8. Perform installation as an unprivileged user and never use administrator or root privileges solely to install this package.
9. Update the documentation to perform verification before installation rather than relying only on npm audit after package code may already have executed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · skill.md (reported line 496)May include surrounding context.

md

### What This Package Does NOT Do / 此包不会做的事

**English:**
- ❌ Does not send data to external servers
- ❌ Does not require API keys or credentials
- ❌ Does not collect telemetry
- ❌ Does not execute arbitrary code from user input

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README advertises the skill for 'Workflow Automation - Natural language triggers' without defining what kinds of phrases should or should not activate downstream skills. Because this is a markdown file and the description is broad, it risks encouraging overly permissive trigger design that could overlap with ordinary user speech.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 496)May include surrounding context.

md

### What This Package Does NOT Do / 此包不会做的事

**English:**
- ❌ Does not send data to external servers
- ❌ Does not require API keys or credentials
- ❌ Does not collect telemetry
- ❌ Does not execute arbitrary code from user input

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · skill.md (reported line 499)May include surrounding context.

md

- ❌ Does not send data to external servers
- ❌ Does not require API keys or credentials
- ❌ Does not collect telemetry
- ❌ Does not execute arbitrary code from user input
- ❌ Does not access sensitive system resources

**中文：**

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The architecture states 'User Intent → Intent Analyzer → Skill Matcher → Skill Execution' in a way that suggests any user intent may be routed directly to execution, but it does not describe boundaries, filtering, or when routing should not occur. In markdown documentation, this can be an ambiguous activation model that lacks specificity on trigger constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file is bilingual throughout, but it does not state whether the skill will operate in English, Chinese, or both, nor whether users can choose their preferred language. For organizations with language or locale policies, presenting a fixed bilingual interface without explicit opt-in or selection guidance can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.