T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/security_audit.py:1275- Finding
Broad Host Reconnaissance Runs by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
Sx Security Audit 1.0.0
Security checks for vulnerabilities and agentic risk
Overview
This security-audit skill is mostly coherent, but it can scan sensitive host data and create or send reports that may expose secrets.
Review before installing or running. Prefer explicit --check selections, inspect generated reports before sharing, avoid Feishu sending unless the webhook or plugin endpoint is trusted, and treat any previously generated reports as sensitive because they may contain credential values or prefixes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security_audit.py:938- Finding
Shell Credential Material Can Be Copied into Persistent Audit Reports
- Content
View full analysis
50 else m for m in matches[:3]] ``` ```python if result.status != "pass": report.append(f"- Issue description: {result.description}") report.append(f"- Affected scope: `{result.impact}`") report.append(f"- Recommended fix: `{result.fix}`") ``` ```python output_path = Path(output_file) output_path.parent.mkdir(parents=True, exist_ok=True) with open(output_path, 'w', encoding='utf-8') as f: f.write(report) ``` ### Technical Analysis The shell audit captures complete regular-expression matches containing both the exported variable name and its value. It then treats truncation to 50 characters as sanitization. This is not effective secret redaction: - Matches of 50 characters or fewer are copied in full. - Longer matches expose their first 50 characters. - Many API keys, passwords, and access tokens fit entirely within the limit. - Even a partial prefix may disclose an account, token family, or enough material to aid credential recovery. - The resulting description is inserted into Markdown and JSON reports. - The report is also printed to the terminal unless quiet mode is enabled. - Report creation does not explicitly enforce owner-only permissions. This behavior conflicts with the reference guidance that sensitive values should not be written to logs ...[truncated 1110 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_report_to_feishu.py:231- Finding
Report Sender Accepts Unrestricted Network Destinations
- Content
View full analysis
bool: try: data = json.dumps(content, ensure_ascii=False).encode('utf-8') req = urllib.request.Request( webhook_url, data=data, headers={'Content-Type': 'application/json'}, ) with urllib.request.urlopen(req, timeout=10) as response: resp_data = json.loads(response.read().decode('utf-8')) ``` ```python api_base = feishu_plugin.get('apiEndpoint', '') if not api_base: print_info("Feishu plugin API endpoint is not configured") return False report_path = Path(report_file) content = _build_rich_text_content(report_path) payload = { "action": "send_message", "session_key": session_key, "content": content, } try: data = json.dumps(payload, ensure_ascii=False).encode('utf-8') req = urllib.request.Request( api_base, data=data, headers={'Content-Type': 'application/json'}, ) with urllib.request.urlopen(req, timeout=15) as response: if response.getcode() == 200: return True ``` ```python if send_via_openclaw_plugin(report_file, session_key): return True if not webhook_url: webhook_url = os.environ.get('FEISHU_WEBHOOK_URL', '') if webhook_url: if format_type == "card": content = _build_interactive_card(report_path) elif format_type == "rich": content = _build_rich_text_content(report_path) else: content = { "msg_type": "text", "content": {"text": format_report_for_feishu(report_path)}, } return send_to_feishu_webhook(content, webhook_url) ``` ### Technical Analysis The sender accepts destinations from: - The `--w ...[truncated 2658 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (77)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is security auditing, but the skill also documents exfiltration-adjacent behavior: reading local OpenClaw configuration, formatting reports, writing message copies to disk, and sending results to Feishu via plugin API or webhook. A security audit skill scans highly sensitive data, so undocumented or underemphasized outbound reporting materially increases the risk of leaking secrets, system details, or findings to external services.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill states it performs broad security auditing but does not prominently warn users that it may inspect sensitive environment variables and may send reports to external services such as Feishu. Because audit output can contain credentials, host details, ports, paths, and policy findings, insufficient disclosure undermines informed consent and increases accidental data exposure risk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/security_audit.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [代码安全最佳实践](references/code-security.md)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
1. 子进程执行检查
python # ❌ 不推荐 - 直接执行用户输入 subprocess.run(user_command, shell=True) # ✅ 推荐 - 使用参数列表 subprocess.run(['ls', '-la', path], shell=False)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 敏感文件最小权限 | 文件类型 | 推荐权限 | 命令 | 说明 | |-----------|-----------|-------|------| | SSH 私钥 | 600 | `chmod 600 ~/.ssh/id_rsa` | 仅所有者可读写 | | SSH 目录 | 700 | `chmod 700 ~/.ssh` | 仅所有者可访问 | | AWS 凭据 | 600 | `chmod 600 ~/.aws/credentials` | 保护 AWS 密钥 | | GPG 目录 | 700 | `chmod 700 ~/.gnupg` | 保护 GPG 密钥 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 敏感文件最小权限 | 文件类型 | 推荐权限 | 命令 | 说明 | |-----------|-----------|-------|------| | SSH 私钥 | 600 | `chmod 600 ~/.ssh/id_rsa` | 仅所有者可读写 | | SSH 目录 | 700 | `chmod 700 ~/.ssh` | 仅所有者可访问 | | AWS 凭据 | 600 | `chmod 600 ~/.aws/credentials` | 保护 AWS 密钥 | | GPG 目录 | 700 | `chmod 700 ~/.gnupg` | 保护 GPG 密钥 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 敏感文件最小权限 | 文件类型 | 推荐权限 | 命令 | 说明 | |-----------|-----------|-------|------| | SSH 私钥 | 600 | `chmod 600 ~/.ssh/id_rsa` | 仅所有者可读写 | | SSH 目录 | 700 | `chmod 700 ~/.ssh` | 仅所有者可访问 | | AWS 凭据 | 600 | `chmod 600 ~/.aws/credentials` | 保护 AWS 密钥 | | GPG 目录 | 700 | `chmod 700 ~/.gnupg` | 保护 GPG 密钥 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md |-----------|-----------|-------|------| | SSH 私钥 | 600 | `chmod 600 ~/.ssh/id_rsa` | 仅所有者可读写 | | SSH 目录 | 700 | `chmod 700 ~/.ssh` | 仅所有者可访问 | | AWS 凭据 | 600 | `chmod 600 ~/.aws/credentials` | 保护 AWS 密钥 | | GPG 目录 | 700 | `chmod 700 ~/.gnupg` | 保护 GPG 密钥 | | OpenClaw 配置 | 600/700 | `chmod 700 ~/.openclaw` | 保护配置 | | 日志文件 | 600/644 | `chmod 600 logs/*.log` | 控制日志访问 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text .gitignore --------- .env .env.local config/secrets.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ``` .gitignore --------- .env .env.local config/secrets.json ```
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
.gitignore
.env .env.local config/secrets.json
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
.env .env.local config/secrets.json
text 4. **使用掩码显示**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python --------- .env .env.local config/secrets.json ``` 4. **使用掩码显示**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python print_header("🔒 检查敏感文件权限") sensitive_files = [ (Path.home() / ".ssh", 0o700), (Path.home() / ".ssh" / "id_rsa", 0o600), (Path.home() / ".ssh" / "id_ed25519", 0o600), (Path.home() / ".aws" / "credentials", 0o600),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python print_header("🔒 检查敏感文件权限") sensitive_files = [ (Path.home() / ".ssh", 0o700), (Path.home() / ".ssh" / "id_rsa", 0o600), (Path.home() / ".ssh" / "id_ed25519", 0o600), (Path.home() / ".aws" / "credentials", 0o600),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python print_header("🔒 检查敏感文件权限") sensitive_files = [ (Path.home() / ".ssh", 0o700), (Path.home() / ".ssh" / "id_rsa", 0o600), (Path.home() / ".ssh" / "id_ed25519", 0o600), (Path.home() / ".aws" / "credentials", 0o600),
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python severity="high", description=f"文件权限过于宽松: {oct(actual_mode)}, 期望: {oct(expected_mode)}", impact=str(path), fix=f"chmod {oct(expected_mode)[2:]} {path}", )) else: results.append(AuditResult(
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The script enumerates all environment variables and inspects their values for secrets, which grants broad access to sensitive credentials present in the process environment. In a security-audit skill this is contextually expected, but it is still dangerous because the collected variable names and classifications are later reported and could expose sensitive operational metadata or leak secrets if logging/report handling changes.
- Content
python exposed = [] for env_name, env_value in os.environ.items(): for pattern, desc in sensitive_env_patterns: if pattern.search(env_name): # 检查值是否是真实密钥（非占位符）
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/security_audit.py:408
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/code-security.md:92