ClawHub
Back to skill

Security audit

inkos

Security checks for vulnerabilities and agentic risk

Overview

InkOS is a coherent writing and translation skill that discloses its local storage and provider API use, with a supply-chain caveat around its unpinned npm install.

Install only from a trusted npm registry and run InkOS with normal user privileges, not admin rights. Review the configured LLM, image, search, aggregator, or custom provider endpoints before use because manuscript content may be sent to them, and prefer environment-backed or Studio-managed secrets instead of literal API keys.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned and Unverifiable Third-Party npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk caused by an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
metadata: { "openclaw": { "emoji": "📖", "requires": { "bins": ["inkos", "node"], "env": ["OPENAI_API_KEY"] }, "primaryEnv": "OPENAI_API_KEY", "homepage": "https://github.com/Narcooo/inkos", "install": [{ "id": "npm", "kind": "node", "package": "@actalk/inkos", "label": "Install InkOS (npm)" }] } }

Technical Analysis

The installation declaration references @actalk/inkos without an exact version or integrity digest. Consequently, installation may resolve to whichever package release the configured npm registry currently serves rather than to the specific implementation associated with the reviewed Skill version.

The audited project contains only SKILL.md and _meta.json. It does not include the dependency source, a package manifest, or a lockfile. The dependency's implementation and lifecycle behavior therefore cannot be verified from this artifact. In particular, the statement at SKILL.md:793 that the npm package has no installation hooks is a documentation claim rather than locally verifiable evidence.

This does not establish that the current dependency is malicious. It creates a supply-chain weakness under which a compromised maintainer account, registry compromise, malicious future release, or unsafe registry substitution could change the code installed after this Skill was reviewed.

Attack Path

  1. An attacker compromises the npm publisher, package release process, registry account, or package distribution channel for @actalk/inkos.
  2. The attacker publishes or substitutes a malicious package release under the same package name.
  3. A user installs the Skill dependency using its unversioned npm declaration.
  4. npm resolves the attacker-controlled release because no exact version or integrity value constrains resolution.
  5. Malicious ...[truncated 1085 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @actalk/inkos to an exact audited version rather than relying on the registry's current release.
  2. Bind the package to a verified integrity digest and reject installation if integrity verification fails.
  3. Include a lockfile, software bill of materials, or vendored auditable source that identifies the complete dependency graph used by Skill version 2.8.3.
  4. Ensure the Skill descriptor version and dependency release are explicitly associated and reviewed together.
  5. Verify the published package archive for lifecycle scripts and unexpected executable content during every release.
  6. Use a trusted npm registry and enforce provenance or signed-release verification where supported.
  7. Install and run the package with least privilege, without administrative rights, and expose only the credentials required for the requested operation.
  8. Treat the claim that installation is inert as a release-time invariant enforced by automated checks rather than solely as documentation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
s the former InkOS-private Skill protocol with standard AgentSkills / OpenClaw `SKILL.md` packages. Skills provide professional guidance and static references o

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
s the former InkOS-private Skill protocol with standard AgentSkills / OpenClaw `SKILL.md` packages. Skills provide professional guidance and static references o

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language guidance explicitly labels 'English novel writing' as 'Native English support,' which can steer agents toward a preferred language mode rather than presenting language choice neutrally. Because this is user-facing skill guidance rather than a clearly justified region-specific constraint, it risks violating language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Configure your LLM provider (OpenAI, Anthropic, or any OpenAI-compatible API)

Prefer --api-key-env so the key never appears in shell history:

export OPENAI_API_KEY=sk-xxx inkos config set-global --provider openai --base-url https://api.openai.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

For compatible/proxy endpoints, use --provider custom and point ONLY to trusted endpoints:

inkos config set-global --provider custom --base-url https://your-trusted-proxy.com/v1 --api-key-env OPENAI_API_KEY --model gpt-4o

text