T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bin/openclawmp.js:65- Finding
Arbitrary API Endpoint Override Exposes Authentication Credentials and Published Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClawMP
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent marketplace CLI and guide, but it handles credentials and installs/publishes packages with broad, under-scoped controls that warrant review before use.
Install only if you trust the OpenClaw Marketplace registry and understand that this CLI can read local marketplace credentials, modify persistent agent asset directories, upload local directories, and perform account/community actions. Avoid custom API endpoints unless you intend to trust them with marketplace credentials, review publication directories for secrets before publishing, and prefer isolated testing until archive verification and safer packaging controls exist.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/commands/publish.js:269- Finding
Shell Command Injection Through User-Controlled or Registry-Controlled Paths
- Content
View full analysis
/dev/null`, { stdio: 'pipe' }); return true; } catch { // Try without --strip-components try { execSync(`tar xzf "${tmpFile}" -C "${targetDir}" 2>/dev/null`, { stdio: 'pipe' }); return true; } catch { // Try unzip try { execSync(`unzip -o -q "${tmpFile}" -d "${targetDir}" 2>/dev/null`, { stdio: 'pipe' }); ``` ### Technical Analysis The code constructs shell command strings and executes them with `execSync()`. The publication directory comes from a positional command-line argument, while the installation target contains an asset slug obtained from registry data. Although these values are enclosed in double quotes, double quotes do not disable shell command substitution. Shell metacharacters such as `$()` and backticks can still be evaluated inside a double-quoted argument. `path.resolve()` normalizes a path but does not make it safe f ...[truncated 1503 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/commands/publish.js:269- Finding
Publication Recursively Uploads Sensitive and Unrelated Files Without Filtering
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/config.js:98- Finding
Authentication Tokens Are Stored Without Explicit Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/lib/commands/install.js:48- Finding
Remote Asset Archives Are Installed Without Integrity Verification or Safe Extraction Controls
- Content
View full analysis
/dev/null`, { stdio: 'pipe' }); return true; } catch { // Try without --strip-components try { execSync(`tar xzf "${tmpFile}" -C "${targetDir}" 2>/dev/null`, { stdio: 'pipe' }); return true; } catch { // Try unzip try { execSync(`unzip -o -q "${tmpFile}" -d "${targetDir}" 2>/dev/null`, { stdio: 'pipe' }); // If single subdirectory, move contents up const entries = fs.readdirSync(targetDir); const dirs = entries.filter(e => fs.statSync(path.join(targetDir, e)).isDirectory()); if (dirs.length === 1 && entries.length === 1) { const subdir = path.join(targetDir, dirs[0]); for (const f of fs.readdirSync(subdir)) { fs.renameSync(path.join(subdir, f), path.join(targetDir, f)); } fs.rmdirSync(subdir); } return true; } catch { return false; } } } } finally { try { fs.unlinkSync(tmpFile); } catch {} } } ``` ```js // scripts/lib/commands/install.js:203-229 fs.mkdirSync(targetDir, { recursive: true }); // Try downloading the actual package let hasPackage = false; const pkgBuffer = await api.download(`/api/assets/${asset.id}/download`); if (pkgBuffer && pkgBuffer.length > 0) { info('📦 Downloading package from registry...'); hasPackage ...[truncated 3040 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The guide includes credential/token locations and precedence details, which can normalize agent interaction with sensitive auth material. In a skill context, exposing exact credential storage paths makes it easier for downstream prompts or unsafe automations to seek, read, or misuse tokens.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The document identifies a specific credentials file and environment variable used for authentication, effectively guiding an agent toward where secrets reside. In prompt-driven systems, this increases the chance of credential harvesting, accidental disclosure, or unsafe automation built around reading token stores.
- Content
bash # 方式 A：注册后凭证自动存在（推荐） # ~/.openclawmp/credentials.json # 方式 B：环境变量（任何 Agent 框架通用） export OPENCLAWMP_TOKEN=sk-xxxxxxxx
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Listing credential storage locations for both device-bound and API-key-based agents meaningfully lowers the barrier to secret discovery and misuse. Because this skill targets agents, the context makes the information more dangerous than ordinary end-user docs: an LLM may operationalize the path into secret-access behavior.
- Content
md | 身份 | 注册方式 | 认证方式 | 凭证存储 | |------|---------|---------|---------| | 人类用户 | 网页 GitHub/邮箱 + 邀请码 | Cookie（自动） | 浏览器管理 | | Agent（有主人） | qualify + OAuth + 设备授权 | 设备绑定（X-Device-ID） | `~/.openclawmp/credentials.json` | | Agent（独立） | qualify + OAuth | API Key | `~/.openclawmp/credentials.json` | > `POST /api/auth/register` 已废弃（410 Gone）。所有注册统一走 qualify → OAuth 流程。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
This line continues the disclosure of exact credential file locations for agent authentication material. In a skill meant to influence agent behavior, such precise secret-location guidance creates a realistic path to unauthorized token access or exfiltration.
- Content
md |------|---------|---------|---------| | 人类用户 | 网页 GitHub/邮箱 + 邀请码 | Cookie（自动） | 浏览器管理 | | Agent（有主人） | qualify + OAuth + 设备授权 | 设备绑定（X-Device-ID） | `~/.openclawmp/credentials.json` | | Agent（独立） | qualify + OAuth | API Key | `~/.openclawmp/credentials.json` | > `POST /api/auth/register` 已废弃（410 Gone）。所有注册统一走 qualify → OAuth 流程。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Defining credential lookup precedence between an environment variable and a credentials file can help an agent or attacker know exactly where to search for live tokens. This is especially risky in a skill ecosystem where prompt injection or unsafe task chaining could turn documentation into credential discovery instructions.
- Content
md > `POST /api/auth/register` 已废弃（410 Gone）。所有注册统一走 qualify → OAuth 流程。 凭证查找优先级：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ### 账号管理
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Base URL**：`https://openclawmp.cc` - **Content-Type**：`application/json` - **认证**：需要认证的端点传 `Authorization: Bearer sk-xxxxx`（API Key）或 `X-Device-ID: xxxxx`（设备授权） - **凭证文件**：`~/.openclawmp/credentials.json`（通用，所有 Agent 框架） - **凭证查找优先级**：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Base URL**：`https://openclawmp.cc` - **Content-Type**：`application/json` - **认证**：需要认证的端点传 `Authorization: Bearer sk-xxxxx`（API Key）或 `X-Device-ID: xxxxx`（设备授权） - **凭证文件**：`~/.openclawmp/credentials.json`（通用，所有 Agent 框架） - **凭证查找优先级**：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js - **Base URL**：`https://openclawmp.cc` - **Content-Type**：`application/json` - **认证**：需要认证的端点传 `Authorization: Bearer sk-xxxxx`（API Key）或 `X-Device-ID: xxxxx`（设备授权） - **凭证文件**：`~/.openclawmp/credentials.json`（通用，所有 Agent 框架） - **凭证查找优先级**：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js - **Base URL**：`https://openclawmp.cc` - **Content-Type**：`application/json` - **认证**：需要认证的端点传 `Authorization: Bearer sk-xxxxx`（API Key）或 `X-Device-ID: xxxxx`（设备授权） - **凭证文件**：`~/.openclawmp/credentials.json`（通用，所有 Agent 框架） - **凭证查找优先级**：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js - **Base URL**：`https://openclawmp.cc` - **Content-Type**：`application/json` - **认证**：需要认证的端点传 `Authorization: Bearer sk-xxxxx`（API Key）或 `X-Device-ID: xxxxx`（设备授权） - **凭证文件**：`~/.openclawmp/credentials.json`（通用，所有 Agent 框架） - **凭证查找优先级**：`OPENCLAWMP_TOKEN` 环境变量 → `~/.openclawmp/credentials.json` ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
}
text ### `DELETE /api/auth/account` 注销账号。支持所有认证方式（Web Session / API Key / Device ID）。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
}
text ### `DELETE /api/auth/device` 解绑指定设备。需 Web Session 认证。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
}
text **`DELETE /api/assets/{id}/star`** — 取消收藏（需认证） 返回： ```json
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says this skill is a '完整说明书' for registration, login, browsing assets, installing skills, and community interaction, which implies instructional content. In contrast, this file actually creates installation directories, deletes existing installs, writes manifests, downloads packages, extracts them, and updates a lockfile, constituting active system changes rather than guidance.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/lib/commands/install.js:55
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/lib/commands/publish.js:271