1688 Cowboy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a merchant reception assistant, but it handles credentials and business-changing automation with unsafe or under-scoped controls that need review before installation.

Install only after reviewing the credential and business-change controls. Treat the AK as a secret, avoid passing it on the command line, ensure local config files are protected, verify the gateway URL cannot be redirected, and confirm that cloud knowledge sync and answer persistence match your privacy expectations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capabilities/configure/service.py:35
• Finding: Configurable Gateway Endpoint Can Exfiltrate AK and Gateway Bearer Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capabilities/configure/service.py`, lines 35–53 **Vulnerability Type**: Untrusted endpoint override and plaintext credential transmission **Risk Level**: High ### Vulnerable Code ```python gateway_url = os.environ.get("OPENCLAW_GATEWAY_URL", "http://localhost:18789") token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") payload = { "skills": { "entries": { SKILL_NAME: { "apiKey": api_key } } } } try: headers = {} if token: headers["Authorization"] = "Bearer {}".format(token) resp = requests.patch("{}/api/config".format(gateway_url), headers=headers, json=payload, timeout=5) return resp.ok ``` ### Technical Analysis `OPENCLAW_GATEWAY_URL` is accepted without validating its scheme, hostname, port, or destination. The configured API key is then placed in the request body, while `OPENCLAW_GATEWAY_TOKEN` is placed in the `Authorization` header. Consequently, a caller that can influence the process environment can redirect both credentials to an arbitrary server. The implementation also permits plaintext HTTP URLs, including the default local URL, without checking that a non-loopback destination uses HTTPS. This behavior exceeds the minimum privileges required for configuring the local OpenClaw gateway. A local configuration operation should only communicate with a trusted loopback or explicitly allowlisted endpoint. ### Attack Path 1. An attacker, malicious launcher, or prompt-injected automation influences the environment used to execute the Skill. 2. The attacker sets `OPENCLAW_GATEWAY_URL` to an attacker-controlled endpoint, for example `http://attacker.example`. 3. The user invokes the AK configuration workflow. 4. `configure_via_gateway()` sends a PATCH request to the attacker-controlled endpoint. 5. The request discloses: - The complete AK in the JSON body. - The OpenClaw g ...[truncated 663 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary endpoint overrides in production builds. 2. Restrict configuration requests to a fixed loopback endpoint or a strict allowlist. 3. Parse the endpoint with `urllib.parse.urlparse()` and enforce: - `https` for remote destinations. - `http` only for `localhost`, `127.0.0.1`, or an approved Unix-domain transport. - Approved ports and no embedded user information. 4. Do not send `OPENCLAW_GATEWAY_TOKEN` to any endpoint that has not passed destination validation. 5. Prefer a Unix-domain socket or authenticated local IPC for gateway configuration. 6. Fail closed instead of falling back after endpoint validation or TLS errors. 7. Add tests proving that external HTTP URLs, DNS rebinding targets, link-local addresses, and non-allowlisted hosts are rejected. 8. Rotate both the AK and gateway token if an untrusted endpoint may previously have been configured. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capabilities/configure/cmd.py:61
• Finding: AK Is Exposed Through Process Arguments, Confirmation Output, and Insecure Plaintext Storage<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/capabilities/configure/cmd.py`, lines 61–72 - `scripts/_risk_guard.py`, lines 66–75 - `scripts/capabilities/configure/service.py`, lines 76–84 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code The AK is accepted directly through the process argument list: ```python ak = sys.argv[1].strip() ``` The complete AK is placed in the confirmation payload: ```python emit_confirmation( message="...", payload={"ak": ak}, preview_markdown="...", ) ``` The confirmation helper serializes the complete payload to standard output: ```python confirm_obj = {"message": message, "payload": payload} sys.stdout.write("<user_confirmation>{}</user_confirmation>\n".format( json.dumps(confirm_obj, ensure_ascii=False) )) sys.stdout.flush() ``` The fallback stores the AK as plaintext without explicitly applying restrictive permissions: ```python skill_entry["apiKey"] = api_key CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(config, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The AK is exposed across three separate channels: 1. **Process argument exposure**: Supplying the AK as `cli.py configure YOUR_AK` places it in the operating-system process argument list. Depending on platform configuration, local users, monitoring agents, shell history, audit systems, and process supervisors may capture it. 2. **Standard-output exposure**: Although the human-readable preview masks the AK, the internal `<user_confirmation>` marker contains `payload={"ak": ak}` and is printed as plaintext. Framework logs or command-output capture can therefore retain the complete credential. 3. **Filesystem exposure**: The fallback writes the AK into `openclaw.json` as plaintext. The code neither sets a restrictive creation mode nor checks or repairs permissions on an existing file. Effective ...[truncated 1534 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Stop accepting credentials as command-line arguments. 2. Read the AK from: - A protected file descriptor. - Standard input with echo disabled. - A platform secret-store API. - A framework-managed opaque secret reference. 3. Do not embed the complete AK in the confirmation payload printed to stdout. Store sensitive pending data in a protected framework-side store and return only an opaque, short-lived transaction identifier. 4. Ensure logs redact AK-like values, authorization headers, confirmation payloads, and environment-derived secrets. 5. Replace direct plaintext JSON storage with the OpenClaw secret store or operating-system keychain. 6. If file fallback is unavoidable: - Create the directory with mode `0700`. - Create the file atomically with mode `0600`. - Reject symlinks and non-regular files. - Verify ownership and permissions before reading or writing. - Repair overly broad permissions where safe. 7. Avoid rewriting the full configuration file non-atomically; write to a protected temporary file, `fsync`, and atomically replace the target. 8. Rotate credentials that may have appeared in command history, logs, or permissively accessible configuration files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_risk_guard.py:31
• Finding: Confirmation Payload Is Trusted Without Authenticity, Ownership, or Replay Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_risk_guard.py`, lines 31–45 **Vulnerability Type**: Authentication and authorization bypass in the confirmation protocol **Risk Level**: Medium ### Vulnerable Code ```python def get_confirmed_payload() -> Optional[Dict[str, Any]]: payload_file = os.environ.get(_CONFIRM_ENV, "").strip() if not payload_file: return None try: with open(payload_file, "r", encoding="utf-8") as f: data = json.load(f) if isinstance(data, dict): return data except Exception: return None return None ``` The configuration command subsequently treats values from this payload as authoritative: ```python payload = get_confirmed_payload() if payload is None: ... return ak = (payload.get("ak") or "").strip() ... _do_write(ak) ``` ### Technical Analysis The confirmation mechanism assumes that the presence of `NEWTON_CONFIRM_PAYLOAD` proves that a user approved the operation. However, the referenced file is accepted without checking: - A cryptographic signature or message authentication code. - A one-time nonce. - Expiration time. - Binding to the command, user, session, or original parameters. - File ownership or restrictive permissions. - Whether the file has already been consumed. - Whether the path points to a regular, non-symlink file. Any caller able to set the environment variable and create a JSON file can fabricate a Phase 2 payload. The Skill code therefore does not independently enforce the stated guarantee that the user must explicitly approve credential or state-changing operations. ### Attack Path 1. An attacker or compromised automation creates a JSON file containing an attacker-selected AK: ```json {"ak": "ATTACKER_CONTROLLED_VALID_AK_VALUE"} ``` 2. The attacker sets `NEWTON_CONFIRM_PAYLOAD` to that file's path. 3. The configuration command is invoked with any nonempty positional argument so that it reaches the write bran ...[truncated 1052 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Move confirmation-state validation into a trusted framework service rather than relying on a caller-controlled environment variable. 2. Sign confirmation payloads with a key unavailable to the Skill process. 3. Bind each confirmation token to: - The exact command and action. - A canonical hash of all approved parameters. - The requesting user and session. - A short expiration time. - A unique, single-use nonce. 4. Reject expired, replayed, malformed, unsigned, or command-mismatched payloads. 5. Open payload files securely: - Require a trusted directory. - Reject symlinks. - Verify owner and mode. - Use `O_NOFOLLOW` where available. 6. Delete or invalidate the payload atomically after successful consumption. 7. Ensure sensitive command service functions cannot be invoked through alternate imports or entry points that bypass the confirmation validator. 8. Add negative tests for forged environment variables, replayed files, altered payload values, symlink substitution, and cross-command token reuse. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Dependency Is Not Pinned or Integrity-Verified<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt`, line 1 **Vulnerability Type**: Non-reproducible and unverified third-party dependency **Risk Level**: Low ### Vulnerable Code ```text requests>=2.28.0 ``` ### Technical Analysis The dependency declaration permits installation of any current or future `requests` version at or above 2.28.0. No lock file, exact version, package hash, or trusted-index constraint is present. This does not prove that the current `requests` package is malicious. However, it makes installations non-reproducible and allows the effective dependency code to change after the Skill package has been reviewed. A compromised future release, compromised package-index account, malicious mirror, or incompatible major release could be installed automatically. Because `requests` processes AK-authenticated gateway traffic and configuration credentials, compromise of this dependency would affect a security-sensitive execution path. ### Attack Path 1. The Skill is installed or rebuilt at a later date. 2. The package installer resolves the newest version satisfying `requests>=2.28.0`. 3. A compromised release, untrusted mirror response, or unexpectedly incompatible version is selected. 4. The installed package executes inside the Skill process. 5. Malicious dependency code can inspect request bodies, authentication headers, environment variables, and local configuration files. ### Impact Assessment A compromised dependency executes with the same operating-system privileges as the Skill. It could access the AK, gateway bearer token, merchant data returned by APIs, and files available to the process. The risk is currently prospective rather than evidence of an active malicious package, so the severity is Low. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to a reviewed exact version. 2. Generate and commit a dependency lock file containing all transitive dependencies. 3. Require cryptographic hashes during installation, for example through a hash-locked requirements file. 4. Install only from an approved package index over authenticated TLS. 5. Use automated dependency scanning and promptly review security advisories. 6. Update dependencies through a controlled process that includes testing and code-review approval. 7. Produce a software bill of materials for released Skill versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (65)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = "Bearer {}".format(token)
        resp = requests.patch("{}/api/config".format(gateway_url),
                             headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 95% confidence
• Finding: The code builds a configuration endpoint URL from the untrusted OPENCLAW_GATEWAY_URL environment variable and then sends the API key to that destination, optionally with a bearer token. If an attacker can influence the environment, they can redirect the request to an attacker-controlled host and exfiltrate credentials, making this an SSRF-style secret-leak issue rather than a harmless configurable endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Direct reading and writing of local configuration plus checking environment-stored credentials is a powerful capability for a merchant-facing assistant. When not clearly scoped in the manifest, this creates a hidden privileged surface that could be abused to alter platform configuration or expose sensitive operational state if other safeguards fail.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This file explicitly states that local folder contents are automatically parsed and synchronized to a cloud knowledge base (OSS), but it does not present any privacy, sensitivity, or transmission warning at the point of description. In the context of local absolute paths and broad file-type support, users may unknowingly upload confidential business documents, creating a real risk of unintended data disclosure to remote storage.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow says that after a folder path is added, cloud synchronization starts automatically, yet there is no explicit warning or consent checkpoint before ongoing upload begins. Because the content comes from a local folder and may continue syncing over time, this increases the chance of silently transmitting newly added sensitive files without the user fully understanding the privacy impact.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements AK credential configuration logic, including validation, confirmation, and persistent write paths, which is unrelated to the stated customer-service assistant purpose. A skill that exposes credential-management behavior outside its declared scope increases the attack surface and can be abused through prompt injection or operator confusion to overwrite platform secrets, especially because the skill metadata gives no justification for handling authentication material.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can write a sensitive AK via gateway or file fallback, creating a secret-modification primitive inside a business assistant skill that should not manage credentials. Even though it includes a confirmation flow and masking, the dangerous part is the presence of credential write capability itself: if invoked in the wrong context, it could replace valid credentials with attacker-controlled ones, causing account compromise, service redirection, or denial of service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The manifest does not declare an explicit tool/permission scope even though the skill clearly contemplates environment access, local file access, and networked CLI operations. Without least-privilege boundaries, an orchestrator may expose more capability than the merchant-facing workflow actually needs, increasing blast radius if the agent is prompt-injected or misrouted.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes very broad phrases such as '接待', '培训', and '知识库', which can cause accidental activation from ordinary conversation. Over-broad invocation increases the chance of the wrong skill taking control, exposing business data, launching workflows, or opening management pages when the user intended something else.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Defaulting vague requests like '知识库' or '学一下' into a specific knowledge-query branch is an ambiguous fallback that may expose operational data or steer the merchant into unintended management flows. Ambiguous routing is especially risky here because the skill can access reports, knowledge artifacts, and management UI entry points.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Comments and documentation claim the whitelist restricts exposure to only current public CLI abilities, but the actual list contains an extra undocumented command. This mismatch is security-relevant because operators and reviewers may trust the documentation while an additional callable path remains available.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI whitelist includes `cowboy_config`, which is not documented in the declared public capabilities and contradicts the stated intent that only SKILL.md-asserted abilities are exposed. Undocumented entry points increase attack surface and can enable unauthorized or unreviewed behavior, especially because the module is dynamically discovered and imported at runtime.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI performs silent usage tracking via `_tracker.report_skill_usage()` without any user notice, consent, or visible disclosure. In a business assistant context, telemetry may include sensitive operational usage patterns or metadata, creating privacy, compliance, and trust risks if collected unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to view or set an AK credential and explicitly allows fallback storage in a local config file, but it does not warn that the AK is a sensitive secret, should be protected with restrictive file permissions, and should not be shared, logged, or committed. In a skill that manages authentication for gateway access, this omission increases the chance of credential exposure through insecure storage practices, especially on shared workstations or in synced home directories.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly states that submitted answers are automatically written to a cloud knowledge base and then reused in future customer interactions, but it does not require a clear user-facing warning about persistence, scope, or downstream effects. In this business context, an operator may unknowingly store sensitive, inaccurate, or policy-violating content that will later be surfaced automatically to buyers, creating data governance and integrity risk.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The usage section lists activation cues such as “评分”, “掌握度”, and “完善度” without narrowing context or providing exclusion conditions. These terms are generic and could overlap with routine discussion, making it unclear when this skill should activate versus when the user is asking a broader question.

Static analysis

No suspicious patterns detected.