Omniclaw Cli Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 0.0.8

Overview

The skill is mostly coherent about using OmniClaw for payments, but it mixes high-impact financial and service-execution authority with under-scoped admin references and an unsafe support script.

Review before installing. Use only with a trusted OmniClaw CLI and Financial Policy Engine, provide a narrowly scoped agent token, avoid setting OMNICLAW_OWNER_TOKEN unless a human intentionally wants this agent to approve confirmations, and do not use serve/--exec outside an isolated environment. Do not run the reference generator as a privileged user until its output path and environment handling are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_cli_reference.py:8

Finding

CLI Reference Generator Writes Outside the Project Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_cli_reference.py, lines 8–9 and 151
Vulnerability Type: Unsafe output path resolution and potential symlink-assisted file overwrite
Risk Level: Medium

Vulnerable Code

python

REPO_ROOT = Path(__file__).resolve().parents[3]
HUMAN_REF = REPO_ROOT / "docs" / "cli-reference.md"

python

HUMAN_REF.write_text(content)

Technical Analysis

The generator calculates the repository root using Path(__file__).resolve().parents[3]. From the project path artifact/scripts/generate_cli_reference.py, this resolves several levels above artifact, rather than to the project root.

In the audited directory layout, the resulting destination is /tmp/docs/cli-reference.md, while the intended project documentation is stored at references/cli-reference.md. Consequently, running the generator modifies a file outside the project boundary.

The call to Path.write_text() also follows symbolic links. If another local user or process can prepare the incorrectly resolved output path, the generated content can be redirected through a symbolic link. The destination remains constrained by the invoking process's filesystem permissions, but execution under a more privileged account could increase the overwrite scope.

Attack Path

1. An attacker determines that the generator writes to the incorrectly resolved external path.
2. Where filesystem permissions allow, the attacker creates the external docs directory and makes cli-reference.md a symbolic link to another file writable by the account expected to run the generator.
3. A user or automation process invokes scripts/generate_cli_reference.sh.
4. The shell script executes scripts/generate_cli_reference.py.
5. The Python script resolves HUMAN_REF outside the project and calls write_text(content).
6. The unrelated external file, or the writable destination of the symbolic link, is overwritten with generated CLI documentation.

...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve the project root from the script directory using the correct ancestor:

python

PROJECT_ROOT = Path(__file__).resolve().parents[1]
HUMAN_REF = PROJECT_ROOT / "references" / "cli-reference.md"

2. Verify that the resolved output remains inside the project before writing:

python

PROJECT_ROOT = Path(__file__).resolve().parents[1]
HUMAN_REF = PROJECT_ROOT / "references" / "cli-reference.md"

resolved_parent = HUMAN_REF.parent.resolve()
if PROJECT_ROOT not in (resolved_parent, *resolved_parent.parents):
    raise RuntimeError("Output path escapes the project directory")

3. Reject symbolic-link output files before replacement and ensure the destination directory is trusted.

4. Write to a securely created temporary file in the same trusted directory, then atomically replace the destination after validation.

5. Add an automated test asserting that the generated destination equals the expected project-relative path and cannot resolve outside the project root.

6. Run the documentation generator with the minimum filesystem privileges required and never invoke it as an administrative user without a specific need.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents an operational skill for actually using the OmniClaw CLI to perform financial and service-exposure tasks. However, the code chunk is a support script whose primary function is to collect --help output from many CLI subcommands and build a markdown reference file. While the generated header text discusses commands like pay, balance, ledger, and serve, the script itself only invokes help screens and writes docs. That is a materially different primary purpose from executing OmniClaw CLI actions, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose presents an operational OmniClaw CLI skill for financial and endpoint-serving actions. The actual code chunk merely runs a documentation-generation script (generate_cli_reference.py) from a shell wrapper. That is a materially different primary purpose from the declared operational CLI behaviors. While documentation generation may support a CLI project, it does not implement the described payment or ledger capabilities, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The script forwards the entire parent environment to the spawned omniclaw-cli process via **os.environ. In a zero-trust CLI/payment context, this can unintentionally expose sensitive tokens, wallet configuration, proxy settings, or CI secrets to the child process and any plugins, telemetry, crashes, or debug output it may trigger.

Content

Scanner excerpt · scripts/generate_cli_reference.py (reported line 129)May include surrounding context.

python

text=True,
            timeout=TIMEOUT_SECONDS,
            check=False,
            env={"OMNICLAW_CLI_NO_BANNER": "1", **os.environ},
        )
    except subprocess.TimeoutExpired:
        fallback = FALLBACK_OUTPUTS.get(title)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes shell execution, environment-variable use, and file-writing capabilities but does not declare explicit tool scope such as allowed tools or permissions. In an agent framework, this weakens least-privilege boundaries and can let the skill be invoked with broader execution authority than a reviewer would expect, especially given the presence of payment actions and optional network-exposed serving.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference includes administrative and wallet-funding operations such as configure, deposit, withdraw, and owner-only confirmation flows even though the skill metadata says this skill is for the CLI execution path only and not for owner setup, wallet provisioning, or policy administration. In an agent setting, documenting these commands expands the action surface and can cause an agent or downstream automation to invoke sensitive financial or administrative operations that exceed intended authority.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says it is not for owner setup or policy-engine administration, but the documented configure command accepts highly sensitive inputs including server URLs, agent tokens, wallet aliases, owner tokens, and even a --show-raw option for raw secrets. This contradiction can mislead an agent into handling or exposing credentials and reconfiguring trust boundaries, which is especially dangerous in a payments tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_cli_reference.py (reported line 122)May include surrounding context.

python

def run_help(title: str, args: list[str]) -> str:
    try:
        proc = subprocess.run(
            args,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,