openmaic
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the OpenMAIC project from a GitHub repository (https://github.com/THU-MAIC/OpenMAIC.git) and installs Node.js packages using pnpm.\n- [COMMAND_EXECUTION]: Automates several shell commands for project setup and execution, including git clone, pnpm install, pnpm dev, pnpm build && pnpm start, and docker compose up.\n- [INDIRECT_PROMPT_INJECTION]: The skill has the capability to read and process local PDF files to generate classroom content. This creates an attack surface where a malicious PDF could contain instructions intended to influence the agent's behavior.\n
- Ingestion points: Reading local PDF files via the /api/parse-pdf endpoint.\n
- Boundary markers: The instructions specify confirming before reading local files, but do not define specific delimiters for the parsed content.\n
- Capability inventory: The skill can execute shell commands (git, pnpm, docker) and make network requests to both local and remote APIs.\n
- Sanitization: Not explicitly handled within the skill instructions; processing is deferred to the OpenMAIC API.\n- [CREDENTIALS_UNSAFE]: The skill reads an accessCode from a local configuration file (~/.openclaw/openclaw.json) and encourages the user to manage various API keys (Anthropic, Google, OpenAI, etc.) in local environment files.\n
- Mitigation: The instructions strictly forbid the agent from asking the user to paste keys into the chat or offering to write them into configuration files, reducing the risk of credential exposure in logs or chat history.
Audit Metadata