Security audit

Nutrient Openclaw 1.2.5

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Nutrient document-processing integration, with expected network document handling and API-key configuration, but users should notice the broad trigger wording and unpinned npm install.

Install this only if you are comfortable sending selected documents or extracted content to Nutrient DWS and storing a Nutrient API key in OpenClaw plugin configuration. For sensitive or regulated documents, use a dedicated revocable API key, confirm Nutrient's retention and privacy terms, and prefer a pinned, reviewed package version if OpenClaw supports it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned npm Plugin Allows Mutable Supply-Chain Code Execution
Content: View full analysis
Remediation: View remediation
" ``` ```bash openclaw plugins install @nutrient-sdk/nutrient-openclaw@ ``` 2. Verify package provenance and integrity before installation. Where supported, require an immutable package digest, npm integrity value, signed provenance statement, or equivalent artifact attestation. 3. Commit and enforce a lockfile if the OpenClaw installation mechanism supports one. Avoid version ranges and floating tags. 4. Review the installed package source and transitive dependency tree for each upgrade. Use dependency scanning and require deliberate approval before changing the pinned version. 5. Run the plugin with least privilege: - Restrict filesystem and environment-variable access. - Expose only the required API credential. - Limit outbound network access to documented Nutrient endpoints. - Use a dedicated, revocable API key with the minimum available permissions. - Isolate document processing from unrelated sensitive host resources. 6. Document the audited package version and its integrity information in the Skill so users can verify they are installing the reviewed artifact. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises activation on generic 'document-processing requests in OpenClaw chats,' which is broader than concrete tool-name or product-name triggers. Overly broad triggers can cause the skill to activate in unrelated conversations and route documents to a third-party processor unexpectedly, creating privacy, consent, and data-handling risk because files are sent over the network.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.