T09 · Insecure Skill Coding Practices
Error
- Location
SKILL-openclaw.md:119- Finding
Shell Argument and Request Injection Through Unsafe Prompt Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Adaptive Review
Security checks for vulnerabilities and agentic risk
Overview
The main review skill is coherent, but the included OpenClaw variant under-discloses code-diff transmission and shows an unsafe curl pattern that could mishandle attacker-controlled diff text.
Review the OpenClaw/local variant carefully before installing or using it. Use only local or trusted HTTPS endpoints, assume full git diffs may be sent to the selected model server, redact secrets before review, and replace the curl JSON construction with a JSON-safe tool such as jq. The default Claude-routing skill itself is simpler and does not show hidden persistence or destructive behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Option 1: Direct copy mkdir -p ~/.claude/skills/adaptive-review cp SKILL.md ~/.claude/skills/adaptive-review/ # Option 2: Clone
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Option 1: Direct copy mkdir -p ~/.claude/skills/adaptive-review cp SKILL.md ~/.claude/skills/adaptive-review/ # Option 2: Clone
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims 'No cloud API required' while also documenting a deep tier that may use a 'cloud proxy' and a generic OpenAI-compatible endpoint. This is dangerous because users may rely on the privacy/offline claim and unknowingly route sensitive code diffs to remote infrastructure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The text asserts 'Full privacy' and 'Works offline' but later instructs users to send diffs to arbitrary HTTP endpoints, including non-local or proxied services. That mismatch can cause unintentional source code disclosure because users are encouraged to trust a privacy property the skill does not actually enforce.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompts interpolate {GIT_DIFF} and the instructions do not clearly warn that the complete diff may be transmitted to the configured API endpoint. In a code review skill, this context makes the issue more dangerous because diffs often contain proprietary code, secrets, credentials, or security-sensitive implementation details.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The curl example sends the review prompt, including the git diff, to an external OpenAI-compatible API endpoint. External transmission is expected for this skill's function, but it is still security-relevant because it can expose sensitive source code to untrusted or misconfigured services, especially over plain HTTP examples or cloud proxies.
- Content
Calling the API
Use curl or your preferred HTTP client to hit the OpenAI-compatible endpoint:
bash curl -s "$ENDPOINT/chat/completions" \