ClawHub
Back to skill

Security audit

Agent Portability Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate portability-audit purpose, but its optional auto-fix mode can rewrite files without enough containment or confirmation.

Install only if you are comfortable with an audit tool that can modify skill files. Prefer audit-only mode for untrusted skills, and avoid running --fix on directories containing symlinks or important files until the tool adds containment checks, confirmation, and backup or diff support.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:40
Finding

Auto-fix follows symbolic links and can modify files outside the audited directory

Content
View full analysis
" if old_path in content: content = content.replace(old_path, new_path, 1) changes.append({"file": item["file"], "old": old_path, "new": new_path}) with open(fpath, 'w') as f: f.write(content) ``` The User-Agent auto-fix has the same unsafe write behavior: ```python for item in result["checks"]["user_agent"] ...[truncated 4355 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/checklist.md (reported line 33)May include surrounding context.

md
DATA_DIR = os.path.expanduser(
    os.environ.get("SKILL_DATA_DIR", "~/.config/my-skill")
)
CREDS_PATH = os.path.join(DATA_DIR, "credentials.json")

# Save with restricted permissions
def save_credentials(data):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes and invokes local scripts that audit and auto-fix files, which implies shell execution plus file read/write and environment-variable access, yet it declares no explicit tool scope such as permissions or allowed-tools. That creates an unnecessary trust gap: a host agent may grant broader capabilities than intended, and users cannot easily verify the minimum access the skill requires before running it.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/checklist.md (reported line 14)May include surrounding context.

md
## Should-Have (warn if missing)

- [ ] **Credential files have `chmod 0o600`** — owner read/write only
- [ ] **SKILL.md uses `<DATA_DIR>` placeholder** — not platform-specific paths
- [ ] **Setup scripts support `--no-browser`** — for headless/SSH machines
- [ ] **User-Agent is generic** — no platform names

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/formatting.md (reported line 25)May include surrounding context.

md
> `~/.openclaw/workspace/data/history/`
> → scripts/check_gmail.py:35

_· · · · · · · · · · · · · · · · · · · · · · · · · · ·_

⚠ *Manual review needed*

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · scripts/audit.py (reported line 40)May include surrounding context.

python
def find_files(skill_dir, extensions=None):
    """Recursively find files in skill directory."""
    if extensions is None:
        extensions = {'.py', '.sh', '.js', '.ts', '.md', '.json', '.yaml', '.yml', '.toml'}
    found = []

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script has an audit role but also includes an auto-fix path that rewrites files in the target skill directory. In a security review context, unexpectedly modifying analyzed content can create integrity and trust issues, especially if users assume the tool is read-only and run it on untrusted or important repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

When --fix is used, the script proceeds directly to rewriting files without an interactive confirmation, backup, or even a mandatory diff preview. This increases the chance of accidental destructive changes to arbitrary skill content supplied by the user, which is risky for an auditing utility expected to be safe-by-default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The top-level docstring documents a two-phase workflow where '--fix' applies changes, while the skill manifest frames the skill as an auditor/checker used for checking portability and compatibility. This documentation therefore reinforces a broader behavior than the stated skill intent, creating an intent mismatch between documented behavior and declared purpose.

Content

No source excerpt is available for this finding.