ClawHub
Back to skill

Security audit

abe-foundry

Security checks for vulnerabilities and agentic risk

Overview

Foundry openly describes powerful meta-programming behavior, but it installs mutable third-party code and can learn, self-modify, and send task context to an external AI service without enough scoping detail.

Install only if you are comfortable with a development assistant that can create and modify OpenClaw capabilities, learn from activity across sessions, and send task content to SkillBoss API Hub. Prefer a pinned, reviewed plugin version, keep auto-learning and publishing disabled unless needed, review every generated diff before enabling it, and avoid using it with secrets or private code unless the provider and retention controls are acceptable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:17
Finding

Unpinned Third-Party Plugin Is Automatically Enabled and Loaded

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:76
Finding

Generated Remote Content Can Become Persistent Executable Capabilities

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:89
Finding

Potentially Sensitive Agent Context Is Sent to an External AI Service Without Documented Minimization Controls

Content
View full analysis
dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # LLM 生成代码/分析文档 result = pilot({"type": "chat", "inputs": {"messages": [{"role": "user", "content": "..."}]}, "prefer": "balanced"}) text = result["result"]["choices"][0]["message"]["content"] # 网页搜索（研究文档、arxiv） result = pilot({"type": "search", "inputs": {"query": "openclaw webhook hooks"}, "prefer": "balanced"}) results = result["result"] # 网页抓取（获取文档页面内容） result = pilot({"type": "scraping", "inputs": {"url": "https://docs.openclaw.ai/hooks"}}) content = result["result"] ``` ``` ```markdown ## How Learning Works Foundry observes its own tool calls and learns: 1. **Failures** → Records error + context 2. **Resolutions** → Links fix to failure → Creates pattern 3. **Patterns** → Injected as context in future conversations ``` ### Technical Analysis The Skill explicitly routes chat prompts, search queries, and scraping requests through `api.heybossai.com`. Sending `SKILLBOSS_A ...[truncated 2456 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Self-Modification

High
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill is designed to generate new extensions and skills, which materially increases its ability to create executable capabilities that persist beyond the current session. In context, this amplifies the blast radius of prompt injection, unsafe code generation, or accidental creation of insecure tooling.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
1. **Research** — Fetch and understand OpenClaw documentation on demand
2. **Write Extensions** — Generate new tools and hooks for OpenClaw
3. **Write Skills** — Create ClawHub-compatible skill packages
4. **Self-Modify** — Add new capabilities to itself
5. **Learn** — Record patterns from failures and successes

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

Self-modification is inherently risky because the skill can alter its own future behavior and capabilities, potentially bypassing assumptions made during initial review. Combined with external AI services and auto-learning, this creates a pathway for capability drift, unsafe persistence, and harder-to-audit changes.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
1. **Research** — Fetch and understand OpenClaw documentation on demand
2. **Write Extensions** — Generate new tools and hooks for OpenClaw
3. **Write Skills** — Create ClawHub-compatible skill packages
4. **Self-Modify** — Add new capabilities to itself
5. **Learn** — Record patterns from failures and successes

All AI inference (LLM, web search, scraping) is routed through **SkillBoss API Hub** using `SKILLBOSS_API_KEY`.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is explicitly user-invocable while advertising broad, self-writing and self-modifying behavior. That combination increases the chance a user can trigger powerful code-generation or capability-extension actions without narrowly scoped safeguards, making misuse or unsafe delegation more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill description announces dependence on a remote API for core AI features but does not pair that statement with a strong warning about third-party data transmission. In context, this is a real privacy and trust concern because the skill is capable of researching, learning, and generating code from user-directed tasks.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
# Foundry

**The forge that forges itself.** A meta-extension for OpenClaw that researches documentation, learns from failures, and writes new capabilities into itself. AI capabilities are powered by **SkillBoss API Hub** (`https://api.heybossai.com/v1/pilot`), providing unified access to LLM, search, scraping, and other AI services.

## Installation

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The configuration enables automatic learning from agent activity and experiences, but the documentation does not clearly warn that prompts, outputs, failures, or contextual data may be captured and retained. This can lead to unintended collection of sensitive user or workspace information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill routes chat, search, and scraping through a third-party API but does not provide a clear warning that user prompts, code, URLs, and possibly workspace-derived content may be transmitted externally. In a self-modifying development skill, that creates substantial risk of data leakage and unintended sharing of proprietary material.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Defining the external API base confirms that the skill is architected around third-party network access for AI operations. In a meta-programming skill that may process internal code or operational context, this external dependency raises meaningful data exfiltration and compliance concerns if not explicitly controlled.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code example performs authenticated POST requests to an external AI hub, transmitting request bodies that may include user content, code, documentation, or other sensitive material. Because the skill is designed for research and code generation, the transmitted data could include proprietary or secret-bearing content unless explicitly minimized and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
- [GitHub](https://github.com/lekt9/openclaw-foundry)
- [Foundry Marketplace](https://api.claw.getfoundry.app)
- [SkillBoss API Hub](https://api.heybossai.com/v1/pilot)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language comments in the API usage example switch to Chinese for explanatory text, but the document does not indicate that multilingual output is optional or intended. This can violate language/locale consistency expectations when the skill otherwise presents itself in English and offers no user opt-in for another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.