T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/server_v3.py:1274- Finding
Unauthenticated Administrative API Exposed to the Local Network
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Operations Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill is an audit and rollback tool, but it exposes powerful local operations and sensitive snapshots with weak controls.
Review this carefully before installing. Only run it on a trusted machine, do not expose port 8080 to a network, avoid using it with privileged accounts, remove ~/.ssh and whole-home snapshots from defaults, and treat rollback as experimental rather than a backup. Do not copy the destructive examples into real directories.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/templates/dashboard_v3.html:675- Finding
Stored Cross-Site Scripting in Operation and Alert Rendering
- Content
View full analysis
{ const time = new Date(op.timestamp).toLocaleString(currentLang === 'zh' ? 'zh-CN' : currentLang === 'ja' ? 'ja-JP' : 'en-US'); const statusClass = op.success ? 'badge-success' : 'badge-danger'; const statusText = op.success ? translations[currentLang].success_badge : translations[currentLang].failed_badge; const itemClass = op.success ? '' : 'failed'; const snapshotTag = op.snapshot_id ? `${translations[currentLang].snapshot_tag}: ${op.snapshot_id.substring(0, 8)}` : ''; html += ``; }); container.innerHTML = html; ``` ```javascript let html = ''; alerts.forEach(alert => { const time = new Date(alert.timestamp).toLocaleString(currentLang === 'zh' ? 'zh-CN' : currentLang === 'ja' ? 'ja-JP' : 'en-US'); html += `${op.friendly_name || op.action} ${snapshotTag}${statusText}🕐 ${time} | 🛠️ ${op.tool_name}...[truncated 1996 chars]${alert.alert_type}${translations[currentLang].resolve_btn}- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audit_wrapper.sh:18- Finding
Python Heredoc Injection and Unsafe Command Evaluation in Audit Wrapper
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/logger.py:105- Finding
Fail-Open and Bypassable Permission Enforcement
- Content
View full analysis
tuple[bool, Optional[str]]: """Check if an operation is allowed based on permission rules""" self.connect() cursor = self.conn.cursor() cursor.execute(""" SELECT rule_name, tool_pattern, action_pattern, path_pattern, allowed FROM permission_rules ORDER BY priority DESC """) import fnmatch import re for rule in cursor.fetchall(): tool_match = fnmatch.fnmatch(tool_name, rule["tool_pattern"]) action_match = fnmatch.fnmatch(action, rule["action_pattern"]) path_match = True if path and rule["path_pattern"]: path_match = fnmatch.fnmatch(path, rule["path_pattern"]) if tool_match and action_match and path_match: self.close() return rule["allowed"], rule["rule_name"] # Default: allow if no rules matched self.close() return True, None ``` ```python default_rules = [ ("protect-etc", "exec", "*", "/etc/*", False, 100), ("protect-usr-bin", "exec", "*", "/usr/bin/*", False, 100), ("protect-ssh", "write|edit", "*", "~/.ssh/*", False, 100), ("allow-read-ops", "read", "*", "*", True, 50), ("log-all-ops", "*", "*", "*", True, 0), ] ``` ```python if tool_name == "exec" and action == "run_command": command = parameters.get("command", "") for path in self.auto_snapshot_paths: if path in command: target_path = path break elif "path" in parameters: target_path = parameters["path"] elif "file_path" in parameters: target_path = parameters["file_path"] allowed, rul ...[truncated 2548 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/snapshot.py:79- Finding
Sensitive SSH and Home-Directory Data Duplicated into Persistent Snapshot Storage
- Content
View full analysis
int: """Create a snapshot of specified paths""" if paths is None: paths = [str(Path.home())] snapshot_data = { ...[truncated 2510 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server.py:282- Finding
Flask Debug Server Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (181)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
This is another duplicate of the same core issue: a dangerous recursive deletion example is shown in a way that could desensitize operators to its severity. Because the skill markets mistake prevention and instant recovery, the surrounding context makes such examples more dangerous, not less.
- Content
md **实现位置：** `scripts/describer.py` **效果：** - ❌ 之前：`exec run_command rm -rf ~/Desktop/截图` - ✅ 现在：`删除了 ~/Desktop/截图` **支持的操作类型：**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
This is another duplicate of the same core issue: a dangerous recursive deletion example is shown in a way that could desensitize operators to its severity. Because the skill markets mistake prevention and instant recovery, the surrounding context makes such examples more dangerous, not less.
- Content
md **实现位置：** `scripts/describer.py` **效果：** - ❌ 之前：`exec run_command rm -rf ~/Desktop/截图` - ✅ 现在：`删除了 ~/Desktop/截图` **支持的操作类型：**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
This is another duplicate of the same core issue: a dangerous recursive deletion example is shown in a way that could desensitize operators to its severity. Because the skill markets mistake prevention and instant recovery, the surrounding context makes such examples more dangerous, not less.
- Content
md **实现位置：** `scripts/describer.py` **效果：** - ❌ 之前：`exec run_command rm -rf ~/Desktop/截图` - ✅ 现在：`删除了 ~/Desktop/截图` **支持的操作类型：**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
This is another duplicate of the same core issue: a dangerous recursive deletion example is shown in a way that could desensitize operators to its severity. Because the skill markets mistake prevention and instant recovery, the surrounding context makes such examples more dangerous, not less.
- Content
md **实现位置:** `scripts/describer.py` **效果:** - ❌ 之前:`exec run_command rm -rf ~/Desktop/截图` - ✅ 现在:`删除了 ~/Desktop/截图` **支持的操作类型:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
The example
audited_exec("rm ~/Desktop/test.txt")demonstrates passing raw shell deletion commands into an execution wrapper. Although the sample target is a test file, documenting direct shell passthrough in an audit wrapper encourages unsafe operational patterns and may be copied into real environments.- Content
from scripts.audited_ops import audited_exec
所有命令自动记录+快照+友好描述
audited_exec("rm ~/Desktop/test.txt")
text ### 2. describer.py - 智能描述生成
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The code snippet demonstrates unsafe parameterization of a generic command execution pathway with
rm -rfagainst a user path. This is risky because readers may infer such commands are sanctioned, auditable, and recoverable by design, even when those assumptions may be false.- Content
desc = OperationDescriber.describe( "exec", "run_command", {"command": "rm -rf ~/Desktop/截图"} )
输出: "删除了 ~/Desktop/截图"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The code snippet demonstrates unsafe parameterization of a generic command execution pathway with
rm -rfagainst a user path. This is risky because readers may infer such commands are sanctioned, auditable, and recoverable by design, even when those assumptions may be false.- Content
desc = OperationDescriber.describe( "exec", "run_command", {"command": "rm -rf ~/Desktop/截图"} )
输出: "删除了 ~/Desktop/截图"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The code snippet demonstrates unsafe parameterization of a generic command execution pathway with
rm -rfagainst a user path. This is risky because readers may infer such commands are sanctioned, auditable, and recoverable by design, even when those assumptions may be false.- Content
desc = OperationDescriber.describe( "exec", "run_command", {"command": "rm -rf ~/Desktop/截图"} )
输出: "删除了 ~/Desktop/截图"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
The quick-start example instructs users to create and then delete a Desktop file via
audited_exec, reinforcing that arbitrary shell deletion is a normal workflow. Even though framed as a demo, users may adapt the pattern to valuable files and overestimate rollback reliability.- Content
python3 << 'EOF' from audited_ops import audited_exec audited_exec("echo 'test' > ~/Desktop/test.txt") audited_exec("rm ~/Desktop/test.txt")
然后在 Web UI 回滚！
EOF
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The line contains a concrete
rm -rfpayload against a user directory, which is an inherently dangerous parameter to showcase in a command-execution wrapper. In the context of an ops-management skill, users may run examples with elevated trust, making accidental data loss more likely.- Content
使用：
bash # 替代普通命令 claw-exec 'rm -rf ~/Desktop/截图' claw-exec 'mv ~/Desktop/duyu ~/Downloads/duyu'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The line contains a concrete
rm -rfpayload against a user directory, which is an inherently dangerous parameter to showcase in a command-execution wrapper. In the context of an ops-management skill, users may run examples with elevated trust, making accidental data loss more likely.- Content
使用：
bash # 替代普通命令 claw-exec 'rm -rf ~/Desktop/截图' claw-exec 'mv ~/Desktop/duyu ~/Downloads/duyu'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The line contains a concrete
rm -rfpayload against a user directory, which is an inherently dangerous parameter to showcase in a command-execution wrapper. In the context of an ops-management skill, users may run examples with elevated trust, making accidental data loss more likely.- Content
使用：
bash # 替代普通命令 claw-exec 'rm -rf ~/Desktop/截图' claw-exec 'mv ~/Desktop/duyu ~/Downloads/duyu'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The Python example includes a direct
rm -rfpayload, demonstrating unsafe parameter handling for an execution helper. This is especially risky in scripted contexts because a copied example can be embedded into automation and repeatedly cause irreversible deletion.- Content
所有命令自动记录
audited_exec("ls -la") audited_exec("rm -rf ~/Desktop/截图")
text ### 方案 3：OpenClaw 技能集成（需要配置）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The Python example includes a direct
rm -rfpayload, demonstrating unsafe parameter handling for an execution helper. This is especially risky in scripted contexts because a copied example can be embedded into automation and repeatedly cause irreversible deletion.- Content
所有命令自动记录
audited_exec("ls -la") audited_exec("rm -rf ~/Desktop/截图")
text ### 方案 3：OpenClaw 技能集成（需要配置）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The Python example includes a direct
rm -rfpayload, demonstrating unsafe parameter handling for an execution helper. This is especially risky in scripted contexts because a copied example can be embedded into automation and repeatedly cause irreversible deletion.- Content
所有命令自动记录
audited_exec("ls -la") audited_exec("rm -rf ~/Desktop/截图")
text ### 方案 3：OpenClaw 技能集成（需要配置）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 🎯 Key Features **Intelligent Descriptions:** Automatically translates technical commands into friendly Chinese (e.g., `rm -rf ~/Desktop/截图` → "删除了 ~/Desktop/截图"). No more cryptic command logs - every action is described in plain language. **Auto-Snapshots:** Every operation automatically creates git-based snapshots before execution. Lightweight, efficient, and completely transparent - your files are protected without impacting performance.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 🎯 Key Features **Intelligent Descriptions:** Automatically translates technical commands into friendly Chinese (e.g., `rm -rf ~/Desktop/截图` → "删除了 ~/Desktop/截图"). No more cryptic command logs - every action is described in plain language. **Auto-Snapshots:** Every operation automatically creates git-based snapshots before execution. Lightweight, efficient, and completely transparent - your files are protected without impacting performance.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 💡 Why This Matters Traditional audit logs show raw commands like `exec run_command rm -rf /path`. This skill shows "Deleted /path" and lets you undo it instantly. Peace of mind for every operation. ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 💡 Why This Matters Traditional audit logs show raw commands like `exec run_command rm -rf /path`. This skill shows "Deleted /path" and lets you undo it instantly. Peace of mind for every operation. ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **📝 Intelligent Chinese Descriptions** Automatically translates technical commands into friendly language. - Before: `exec run_command rm -rf ~/Desktop/截图` - After: `删除了 ~/Desktop/截图` **📸 Automatic Git-Based Snapshots**
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant again highlights unsupported claims of multilingual dashboarding, permission controls, alerts, and seamless oversight, while suggesting rollback may be incomplete or broken. In a high-trust ops tool, incomplete safeguards combined with dangerous command execution create meaningful user-harm potential even without overt malice.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant again highlights unsupported claims of multilingual dashboarding, permission controls, alerts, and seamless oversight, while suggesting rollback may be incomplete or broken. In a high-trust ops tool, incomplete safeguards combined with dangerous command execution create meaningful user-harm potential even without overt malice.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant again highlights unsupported claims of multilingual dashboarding, permission controls, alerts, and seamless oversight, while suggesting rollback may be incomplete or broken. In a high-trust ops tool, incomplete safeguards combined with dangerous command execution create meaningful user-harm potential even without overt malice.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant again highlights unsupported claims of multilingual dashboarding, permission controls, alerts, and seamless oversight, while suggesting rollback may be incomplete or broken. In a high-trust ops tool, incomplete safeguards combined with dangerous command execution create meaningful user-harm potential even without overt malice.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant again highlights unsupported claims of multilingual dashboarding, permission controls, alerts, and seamless oversight, while suggesting rollback may be incomplete or broken. In a high-trust ops tool, incomplete safeguards combined with dangerous command execution create meaningful user-harm potential even without overt malice.
- Content
Static analysis
No suspicious patterns detected.