Security Audit Report

Lifepath

Security Score: 3/100
Risk Level: High
Audited by: Sehil Systems Studio - The Trench
Date: 4/30/2026
Files: 21

Continuously monitored by ClawSecure Watchtower

Findings Overview

  • Total Findings: 15
  • Critical: 0
  • High: 8
  • Medium: 6
  • Low: 1
  • Info: 0

Source: Lifepath

SHA-256: 188fa134e891...

lifepath is a skill for the OpenClaw ecosystem, created by Sehil Systems Studio - The Trench. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 3/100, indicating significant security concerns that require attention. The audit identified 15 findings, with issues detected across multiple security layers.

3-Layer Audit Protocol

ClawSecure Proprietary Engine

  • Issue: Missing config.json - agent may not be properly configured
  • Findings: 1 (WARNING)

Advanced Static & Behavioral Analysis

  • Issues:
    • Only 40% of skill content could be analyzed. 12 of 21 files are opaque to the scanner. The safety assessment has low confidence.
    • Pattern detected: fs.readFileSync(
    • Pattern detected: fetch( (plus 2 more)
  • Findings: 5 (CRITICAL)

Supply Chain Security

  • Issues:
    • Vulnerability in axios@1.7.9: Normalization Bypass leading to SSRF.
    • Vulnerability in axios@1.7.9: Denial of Service vulnerability.
    • Additional vulnerabilities found in axios and fastify (multiple findings).
  • Findings: 9 (CRITICAL)

Findings by Level

HIGH

  • F-001: Only 40% of skill content could be analyzed.
  • F-002: Pattern detected: fs.readFileSync( in scripts/init-db.js:20.
  • F-003: Pattern detected: fs.writeFileSync( in src/services/imageService.js:175.
  • F-004: Vulnerability in axios@1.7.9 related to denial of service (package.json).
  • F-005: Additional vulnerabilities for axios in package.json.
  • F-006: Requests vulnerable to SSRF and credential leakage (package.json).
  • F-007: Fastify's Content-Type header tab character allows body validation bypass (package.json).
  • F-008: Fastify vulnerability to invalid content-type parsing (package.json).

MEDIUM

  • F-001: Pattern detected: fetch( in src/routes/moltbook.js:32.
  • F-002: Pattern detected: axios.post( in src/services/imageService.js:143.
  • F-003: Missing config.json (Identity & Privilege Abuse).
  • F-004: Vulnerability in axios related to normalization bypass (package.json).
  • F-005: Axios has unrestricted cloud metadata exfiltration via header injection (package.json).
  • F-006: Fastify request.protocol and request.host spoofable (package.json).

LOW

  • F-001: Fastify vulnerable to DoS via unbounded memory allocation (package.json).

OWASP ASI Framework Coverage

ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories.

Security Recommendations for Lifepath

  • Pin npm dependencies to exact versions to prevent unauthorized code from entering.
  • Add a config.json permissions manifest to declare necessary permissions for clarity before installation.
  • Audit external network connections to ensure all outbound connections are trusted to prevent data exfiltration.

Additional Information

Scanned on April 30, 2026. Lifepath is one of 2,890+ agents audited by ClawSecure.

Learn more at OWASP.