Is icarus-chen/skillnet safe?
https://github.com/openclaw/skills/tree/main/skills/icarus-chen/skillnet
The icarus-chen/skillnet skill presents serious systemic security risks through architectural design rather than overt malware. It mandates autonomous agent actions without user consent across nearly all normal user behaviors, constructs a persistent skill supply chain enabling second-order prompt injection from a third-party Chinese-hosted registry (api-skillnet.openkg.cn), continuously leaks task context to that foreign API, and silently collects and routes user credentials through an unverified PyPI package. While no overtly malicious static code was found, no canary content was exfiltrated, and clone-phase network activity was benign, the combination of mandatory behavioral injection, untrusted supply chain execution, and credential harvesting infrastructure makes this skill dangerous to any agent that loads it.
Category Scores
Findings (9)
CRITICAL Mandatory Autonomous Actions Without User Consent -45 ▶
SKILL.md explicitly instructs the agent to take unsanctioned actions across a broad set of triggers. The combination of 'No user permission needed to search, download, or load' with 'act immediately — do not wait for user instruction' effectively removes user oversight from a large fraction of agent behavior. The skill inserts itself as a mandatory preprocessing step into every multi-step task, regardless of whether the user requested it.
CRITICAL Second-Order Prompt Injection via Untrusted Skill Supply Chain -65 ▶
The skill creates a mechanism to download arbitrary SKILL.md files from api-skillnet.openkg.cn and inject them directly into the agent's active context as executable instructions. An attacker controlling any SkillNet registry entry — or the registry itself — can achieve arbitrary agent instruction injection. The agent is explicitly told to extract and apply instructions from downloaded skill content, including running bundled scripts.
HIGH Continuous Task Context Leakage to Foreign Third-Party API -30 ▶
Every non-trivial agent task triggers a keyword search to api-skillnet.openkg.cn before execution, revealing what the user is working on to an external Chinese-hosted service. The SKILL.md notes this service has no rate limit and no API key requirement — meaning all queries flow freely with no accountability. Over time this constitutes comprehensive surveillance of user activity.
HIGH Credential Collection Routed Through Unverified Third-Party Package -30 ▶
The skill solicits sensitive credentials (API_KEY for LLM access, GITHUB_TOKEN) from users and routes them through the unverified skillnet-ai PyPI package. These credentials are then used to communicate with external endpoints. The 'silent use' design means users may not realize their credentials are being consumed. The package's source code and network behavior cannot be verified from this skill alone.
HIGH Unverified Third-Party Package with Privileged Execution -35 ▶
The skill installs skillnet-ai from PyPI — a package with no verifiable audit trail in this context. The package executes with full user privileges, communicates with api-skillnet.openkg.cn and the configured LLM endpoint, and handles sensitive credentials. PyPI packages can include arbitrary code executed at import or runtime.
HIGH Universal User-Data Intercept via Broad Trigger Conditions -20 ▶
The in-task triggers activate automatically on nearly all normal user behaviors: sharing any GitHub URL, any document, any log file. Each trigger silently invokes skillnet create, sending user content to an external LLM endpoint without explicit user approval. This covers the majority of typical agent interaction patterns.
MEDIUM All Six Canary Credential Files Accessed During Monitoring -20 ▶
Both inotify filesystem events and auditd PATH records confirm that .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP application_default_credentials.json were opened and read twice during the monitoring window. File content was not modified. Timing of accesses (1771915939 = pre-clone, 1771915956 = post-analysis) is consistent with oathe framework canary management rather than skill-triggered reconnaissance, but the full access pattern across all credential file types is noted as significant.
MEDIUM Persistent ~/.openclaw/workspace/skills Library Creates Ongoing Attack Surface -20 ▶
Downloaded skills persist in ~/.openclaw/workspace/skills and are automatically consulted on future tasks. Any malicious skill installed once continues to inject instructions indefinitely. The dedup check in SKILL.md creates an automatic replacement mechanism — an attacker can push an updated malicious skill to replace a legitimate one.
LOW Expected External Connections During Installation -10 ▶
During installation, the git clone process connected to GitHub (140.82.121.3:443) as expected. Canonical/Ubuntu infrastructure connections (185.125.188.58-59:443) reflect background sshd and system services, not skill behavior. No unexpected destinations were observed during the clone phase.