Reliable Tool Context

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent command-output handling helper, with a normal third-party CLI dependency and no evidence of hidden persistence, snooping, exfiltration, or destructive behavior.

Review the upstream sift-gateway package before installing and consider pinning a known-good version. Treat captured command output as potentially sensitive and avoid sending secrets or unrelated private data through the gateway unless that is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:5` and `README.md:61-69` **Vulnerability Type**: Unpinned package installation from an external package registry **Risk Level**: Medium ### Vulnerable Code `SKILL.md:5`: ```yaml metadata: {"openclaw":{"skillKey":"sift-gateway-reliable-tool-context","homepage":"https://github.com/lourencomaciel/sift-gateway/tree/main/docs/openclaw","requires":{"bins":["sift-gateway"]},"install":[{"id":"uv","kind":"uv","package":"sift-gateway","bins":["sift-gateway"],"label":"Install Sift Gateway (uv)"}]}} ``` `README.md:61-69`: ```bash uv tool install sift-gateway ``` Alternative: ```bash pipx install sift-gateway ``` ### Technical Analysis The skill metadata and installation documentation instruct users or supporting tooling to install `sift-gateway` without specifying an exact version, package hash, signature, lockfile, or immutable source revision. Consequently, installation resolves whatever release the configured package registry considers current at that time. This creates a supply-chain trust boundary that cannot be validated from the audited project. The project contains only documentation and skill instructions; it does not include the dependency's implementation for review. If the package publisher account, distribution infrastructure, or package itself were compromised, a malicious future release could be installed without requiring changes to this skill package. Because the installed dependency provides command-line entry points and is intended to capture and process command output, compromise would be particularly sensitive: malicious dependency code could execute with the installing user's permissions and inspect data routed through the gateway. ### Attack Path 1. An attacker compromises the package publisher account, package registry distribution path, or a future `sift-gateway` release. 2. The attacker publishes a malicious release under the expected pa ...[truncated 1349 chars]
• Remediation: ## Remediation Suggestions 1. Pin `sift-gateway` to an exact, reviewed version in both skill metadata and installation examples. 2. Ensure the metadata installation mechanism supports exact-version constraints; otherwise, provide a controlled installer that rejects unapproved versions. 3. Verify package integrity using cryptographic hashes or signed release artifacts where supported. 4. Maintain a lockfile or equivalent reproducible dependency manifest, including transitive dependencies. 5. Document the approved package registry and avoid fallback to untrusted indexes. 6. Add automated dependency monitoring and require security review before updating the approved version. 7. Run the installed tool with least privilege and avoid exposing unrelated secrets or sensitive environment variables. 8. Where practical, isolate command-output processing in a sandbox or restricted execution environment.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

pipx install sift-gateway
```

2. Write the packaged skill file:

```bash
mkdir -p ~/.openclaw/skills/reliable-tool-context

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
mkdir -p ~/.openclaw/skills/reliable-tool-context
sift-gateway-openclaw-skill --output ~/.openclaw/skills/reliable-tool-context/SKILL.md
```

3. Ensure OpenClaw loads that directory (or explicitly enable the skill in your

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.