Why this verdict
- suspicious: finding skill:skills/cloudflare-registrar:skills/cloudflare-registrar/SKILL.md:14:CRED
- suspicious: finding skill:skills/cloudflare-registrar:skills/cloudflare-registrar/SKILL.md:27:SUPPLY
- suspicious: finding skill:skills/cloudflare-registrar:skills/cloudflare-registrar/SKILL.md:28:SUPPLY
Security findings 3
Credential access
highContextual riskmedium confidenceSKILL.md defers secret handling for OPENCLAW_CLOUDFLARE_API_TOKEN to a root secret rule whose defining root instruction file is not shipped, leaving the operative rules for exporting and transmitting the Cloudflare token unreviewable at runtime.
Secrets: follow the root secret rule; export only needed Cloudflare vars for one command.
vector:instruction
Counter-argument considered
Line 14 delegates OPENCLAW_CLOUDFLARE_API_TOKEN handling to 'the root secret rule', and the requested defining file AGENTS.md is NOT IN REPOSITORY, so the operative rules for exporting and transmitting the token resolve only at runtime and nothing shipped constrains them; the in-artifact mitigations ('export only needed Cloudflare vars for one command', 'Do not print tokens') minimize exposure but do not restore the missing rule, so the CRED finding stands.
Supply chain
mediumContextual risklow confidenceThe skill's Commands section instructs the agent to run `npx mcporter` without a pinned version, causing a package to be fetched and executed from the npm registry at runtime for the declared registrar workflow.
npx mcporter call cloudflare-openclaw.execute
vector:instruction
Counter-argument considered
The commands are concretely instructed and invoke npx with no version pin, so the fetch-and-execute of mcporter from the npm registry at runtime falls outside the pinned-official-registry carve-out and the finding stands as a low-severity supply exposure. It is not concealed - the exact commands are shown openly and serve the declared mcporter workflow - so it is not refuted, only narrow.
Supply chain
mediumContextual riskmedium confidenceSKILL.md instructs the agent to run embedded JavaScript through the execute tool of an MCP server named cloudflare-openclaw via unpinned npx mcporter while the server-defining mcporter.json is not shipped, so at runtime the agent executes whatever server definition and package version then resolve, with no reviewable pin or code constraint.
npx mcporter call cloudflare-openclaw.execute
vector:instruction
Counter-argument considered
Lines 27-57 instruct the agent to hand embedded JavaScript to cloudflare-openclaw.execute via unpinned 'npx mcporter', and the requested server-defining mcporter.json is NOT IN REPOSITORY, so the server definition, the cloudflare helper, and the package version that execute the code resolve only at runtime with no reviewable pin; the shown payloads being benign Cloudflare calls does not constrain what resolves at runtime, and the pinned-install carve-out does not apply to an unpinned invocation.
Open questions 7
What the analysis could not settle from the code alone.
[file request mcporter.json] Does mcporter.json (or its equivalent config) map the cloudflare-openclaw server referenced by the skill to a command or URL, is the package/version pinned, and does its execute tool constrain evaluated code to Cloudflare API requests?
Supply chain
[file request CLAUDE.md] Does this root-level agent instruction file define the 'root secret rule' that SKILL.md's Defaults section invokes, and does it instruct anything about exporting, handling, or transmitting Cloudflare secrets such as OPENCLAW_CLOUDFLARE_API_TOKEN?
Credential access
[file request SKILL.md] What does the root secret rule referenced by the skill's Defaults section instruct about exporting Cloudflare environment variables such as OPENCLAW_CLOUDFLARE_API_TOKEN, and does it route those values anywhere besides the Cloudflare command?
Credential access
[file request AGENTS.md] The Defaults section says 'Secrets: follow the root secret rule; export only needed Cloudflare vars for one command' (SKILL.md line 15). What does the root secret rule instruct about handling, exporting, or transmitting secrets?
Credential access
[file request .mcp.json] What does the 'cloudflare-openclaw' MCP server named in the Defaults section actually run (command/URL), and does its 'execute' tool restrict evaluated code to Cloudflare API requests, or is it a generic code-execution endpoint?
Code execution
[file request skills/cloudflare-registrar/SKILL.md] How do the omitted setup lines between the frontmatter and the Commands section establish ${accountId} and authentication (API token source, env vars, config files), and do they instruct any installs, config writes, or network calls?
Credential access
[file request .mcp.json] Does this file register the cloudflare-openclaw MCP server referenced by the skill, and what command or URL launches it (pinned package, local script, or remote endpoint)?
Supply chain
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedlow confidenceThe skill instructs the agent to run npx mcporter commands that pass arbitrary JavaScript source strings to the generic cloudflare-openclaw.execute tool, routing the skill's Cloudflare operations through an arbitrary-code-execution channel whose full behavior depends on the undocumented execute tool, though the shown payloads only perform domain availability, registration, and listing calls matching the declared purpose.
npx mcporter call cloudflare-openclaw.execute code='async () => {Why it was refuted
The instructed code strings perform exactly the skill's declared core capability - registrar domain-check, registrations, and listing calls through the declared mcporter/cloudflare-openclaw vehicle - which is an accepted carve-out; the finding itself concedes the shown payloads match the declared purpose, and no shown command exceeds it.
Coverage gaps 17
Parts of the artifact the static analysis could not fully examine.
context:symlink_escape target '../../agent-skills/skills/autoreview' leaves the repository root
skills/autoreview
context:symlink_escape target '../../agent-skills/skills/behavior-validator' leaves the repository root
skills/behavior-validator
context:symlink_escape target '../../birdclaw/.agents/skills/birdclaw' leaves the repository root
skills/birdclaw
context:symlink_escape target '../../agent-skills/skills/crabbox' leaves the repository root
skills/crabbox
context:symlink_escape target '../../discrawl/.agents/skills/discrawl' leaves the repository root
skills/discrawl
context:symlink_escape target '../../gitcrawl/.agents/skills/gitcrawl' leaves the repository root
skills/gitcrawl
context:symlink_escape target '../../gogcli/.agents/skills/gog' leaves the repository root
skills/gog
context:symlink_escape target '../../graincrawl/.agents/skills/graincrawl' leaves the repository root
skills/graincrawl
context:symlink_escape target '../../agent-skills/skills/handoff' leaves the repository root
skills/handoff
context:symlink_escape target '../../imsg/.agents/skills/imsg' leaves the repository root
skills/imsg
context:symlink_escape target '../../peekaboo/skills/peekaboo' leaves the repository root
skills/peekaboo
context:symlink_escape target '../../agent-skills/skills/session-viewer' leaves the repository root
skills/session-viewer
context:symlink_escape target '../../slacrawl/.agents/skills/slacrawl' leaves the repository root
skills/slacrawl
context:symlink_escape target '../../wacli/.agents/skills/wacli' leaves the repository root
skills/wacli
context:symlink_escape target '../../wacrawl/.agents/skills/wacrawl' leaves the repository root
skills/wacrawl
ledger_unknown run 1: instruction-surface.0 SRC:9ecf0f8366fec
ledger_missing run 1: instruction-surface.0 SRC:9ecf0f8366fc6fec
