Security audit

skill-refiner

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it can direct an agent to scan broadly and change or delete skill files without enough user control.

Install only if you intend to let the agent audit and potentially repair all OpenClaw skills in a workspace. Run it in report-only mode first, review every proposed deletion, rename, or move, and avoid using unpinned npx commands for sensitive workspaces.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:48
Finding: Unbounded Destructive Workspace Repair
Content: View full analysis
/` 6. **Naming violations** — Rename directory to lowercase-hyphen-case ``` The filename-based classification that feeds this workflow is implemented in `scripts/audit_skill.py:14-17, 82-85`: ```python EXTRANEOUS_FILES = { 'README.md', 'INSTALLATION_GUIDE.md', 'QUICK_REFERENCE.md', 'CHANGELOG.md', 'INSTALL.md', 'SETUP.md', 'CONTRIBUTING.md', } # 4. Extraneous files for fname in EXTRANEOUS_FILES: if (path / fname).exists(): issues.append(f"Extraneous file: {fname} (remove — skills should not contain auxiliary docs)") ``` ### Technical Analysis The skill discovers every `SKILL.md` beneath the entire workspace rather than restricting discovery to an explicitly authorized skill directory. It then directs the Agent to modify frontmatter, delete files, move directories, and rename directories for every result classified as non-compliant. These destructive actions lack: - Explicit user confirmation for each change. - Canonical-path and workspace-boundary validation. - Verification that ...[truncated 2408 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill both audits and fixes all skills, and that it exhaustively searches the entire workspace for every SKILL.md. In the supplied code, the shell script only invokes a discovery helper, runs an audit helper on each found skill, and reports results. There is no visible remediation or modification step, so the primary claimed capability of fixing/repairing skills is not represented. The workspace-scanning claim may or may not be true depending on the external helper, but this chunk itself only demonstrates delegated discovery of skills and auditing/reporting. Therefore the description overstates the implemented behavior in a material way.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description promises a workspace-wide audit-and-fix tool that finds every SKILL.md and repairs each non-compliant skill. The code only audits one skill directory passed as a command-line argument. It validates SKILL.md structure, naming, extraneous files, subdirectories, length, and references, and returns issues/warnings as JSON. There is no logic for scanning the whole workspace, enumerating multiple skills, or editing files to fix problems. This is a material description/behavior mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a full audit-and-fix workflow across all skills in the workspace. The provided code only implements the discovery portion: it finds SKILL.md files and prints their containing directories. It does not inspect file contents, assess compliance, repair issues, or make any modifications. While searching the entire workspace for SKILL.md aligns with part of the description, the primary declared purpose is materially broader than the actual behavior, so this is a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
This searches the **entire workspace** for `SKILL.md` files (not just `skills/`). Skills created without following skill-creator conventions may end up anywhere

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
This searches the **entire workspace** for `SKILL.md` files (not just `skills/`). Skills created without following skill-creator conventions may end up anywhere

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrase audit my skills is broad and likely to overlap with ordinary user requests, which can cause this skill to activate unexpectedly across a workspace-wide scan and repair workflow. Because the skill explicitly claims to exhaustively search the entire workspace and fix non-compliant skills, accidental activation could lead to unintended file discovery and modification beyond what the user narrowly intended.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation examples "审计我的 skills" and "检查 skill 合规性" are fairly broad and can overlap with normal user discussion about skills, increasing the chance that the skill is invoked unintentionally. Because this skill exhaustively scans the entire workspace and repairs files, accidental activation could trigger wide-reaching file inspection and modification beyond what the user explicitly intended.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger phrases are broad ('refine skills', 'audit skills', 'check skill quality', 'fix non-compliant skills') and can match common user requests, causing this powerful workspace-modifying skill to activate in situations where the user may only want advice or a limited review. Because the skill includes destructive remediation steps, overbroad triggering increases the risk of unintended file modifications across the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs destructive actions such as deleting files, moving skills, and renaming directories without requiring user confirmation, backups, dry-run output, or warnings. In a workspace-wide auditing skill, this is dangerous because broad application of automated cleanup can cause irreversible data loss or break projects if benign files are misclassified as 'extraneous.'
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: The instruction to move skills outside skills/ into ~/.openclaw/workspace/skills/<skill-name>/ directs persistent filesystem reorganization in a user-level workspace path. Combined with broad discovery and repair behavior, this can silently alter long-term workspace state, relocate projects unexpectedly, and interfere with other tooling or user organization without explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
1. **Missing/malformed frontmatter** — Add or correct the `---` block with `name` and `description` only 2. **Extra frontmatter fields** — Remove any fields other than `name` and `description` 3. **Weak description** — Rewrite to include: what the skill does + trigger conditions ("Use when...") 4. **Extraneous files** — Delete README.md, INSTALLATION_GUIDE.md, CHANGELOG.md, etc. 5. **Wrong location** — If a skill is outside `skills/`, move it to `~/.openclaw/workspace/skills/<skill-name>/` 6. **Naming violations** — Rename directory to lowercase-hyphen-case

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The usage comment instructs operators to run the tool via npx skill-refiner without pinning an exact package version. This allows whatever version is current in the registry at execution time to be fetched and run, which creates a supply-chain risk if a malicious or compromised package version is published or if an unexpected update changes behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This code reads the contents of a user-supplied file path and processes its text, which can expose user data from that file during auditing. In this file there is no confirmation prompt, user-facing notice, or inline warning comment specifically disclosing that file contents will be read.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.