Reliable Tool Context

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent command-output handling helper, with a normal third-party CLI dependency and no evidence of hidden persistence, snooping, exfiltration, or destructive behavior.

Review the upstream sift-gateway package before installing and consider pinning a known-good version. Treat captured command output as potentially sensitive and avoid sending secrets or unrelated private data through the gateway unless that is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and README.md:61-69
Vulnerability Type: Unpinned package installation from an external package registry
Risk Level: Medium

Vulnerable Code

SKILL.md:5:

yaml

metadata: {"openclaw":{"skillKey":"sift-gateway-reliable-tool-context","homepage":"https://github.com/lourencomaciel/sift-gateway/tree/main/docs/openclaw","requires":{"bins":["sift-gateway"]},"install":[{"id":"uv","kind":"uv","package":"sift-gateway","bins":["sift-gateway"],"label":"Install Sift Gateway (uv)"}]}}

README.md:61-69:

bash

uv tool install sift-gateway

Alternative:

bash

pipx install sift-gateway

Technical Analysis

The skill metadata and installation documentation instruct users or supporting tooling to install sift-gateway without specifying an exact version, package hash, signature, lockfile, or immutable source revision. Consequently, installation resolves whatever release the configured package registry considers current at that time.

This creates a supply-chain trust boundary that cannot be validated from the audited project. The project contains only documentation and skill instructions; it does not include the dependency's implementation for review. If the package publisher account, distribution infrastructure, or package itself were compromised, a malicious future release could be installed without requiring changes to this skill package.

Because the installed dependency provides command-line entry points and is intended to capture and process command output, compromise would be particularly sensitive: malicious dependency code could execute with the installing user's permissions and inspect data routed through the gateway.

Attack Path

1. An attacker compromises the package publisher account, package registry distribution path, or a future sift-gateway release.
2. The attacker publishes a malicious release under the expected pa ...[truncated 1349 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin sift-gateway to an exact, reviewed version in both skill metadata and installation examples.
2. Ensure the metadata installation mechanism supports exact-version constraints; otherwise, provide a controlled installer that rejects unapproved versions.
3. Verify package integrity using cryptographic hashes or signed release artifacts where supported.
4. Maintain a lockfile or equivalent reproducible dependency manifest, including transitive dependencies.
5. Document the approved package registry and avoid fallback to untrusted indexes.
6. Add automated dependency monitoring and require security review before updating the approved version.
7. Run the installed tool with least privilege and avoid exposing unrelated secrets or sensitive environment variables.
8. Where practical, isolate command-output processing in a sandbox or restricted execution environment.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

pipx install sift-gateway

text

2. Write the packaged skill file:

```bash
mkdir -p ~/.openclaw/skills/reliable-tool-context

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

bash

mkdir -p ~/.openclaw/skills/reliable-tool-context
sift-gateway-openclaw-skill --output ~/.openclaw/skills/reliable-tool-context/SKILL.md

3. Ensure OpenClaw loads that directory (or explicitly enable the skill in your