T09 · Insecure Skill Coding Practices
Warning
- Location
clawskillshield/skill.py:13- Finding
Security Scanner Excludes Skill Instruction Files
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawSkillShield
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local security scanner, but its quarantine feature can automatically move or delete local directories without enough safeguards.
Install only if you are comfortable with a local scanner that can read files under paths you provide and can move directories into quarantine. Do not let an agent call quarantine automatically; require human approval, verify the path is an intended skill directory, and keep backups of anything important.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
clawskillshield/skill.py:23- Finding
Unsafe Quarantine Replacement Can Recursively Delete Existing Data
- Content
View full analysis
str: """Quarantine a risky skill – agents can call this autonomously.""" quarantine_dir = os.path.expanduser("~/.openclaw/quarantine") os.makedirs(quarantine_dir, exist_ok=True) target = os.path.join(quarantine_dir, os.path.basename(path)) if os.path.exists(target): shutil.rmtree(target, ignore_errors=True) shutil.move(path, target) ``` ### Technical Analysis The `quarantine()` API accepts an arbitrary path without confirming that it identifies a regular Skill directory. It derives the destination solely from the source basename. If an entry with the same basename already exists in the quarantine directory, that destination is recursively deleted before the new source is moved. This replacement behavior creates a basename-collision vulnerability. An attacker who can influence the path passed to an autonomous quarantine call can cause existing quarantined evidence or unrelated content with a matching destination name to be removed. The use of `ignore_errors=True` further suppresses deletion failures and reduces visibility into partial or inconsistent operations. The function also does not reject filesystem roots, paths already inside the quarantine directory, non-directory sources, or paths resolving outside an expected Skills root. Consequently, a malformed or attacker-influenced API call can target arbitrary filesystem objects accessible to the invoking user. ### Attack Path 1. An existing directory such as `~/.openclaw/quarantine/example` contains prior quarantine evidence or unrelated data. 2. An attacker supplies or causes an autonomous Agent to process another accessible path whose basename is also `example`. 3. The Agent invokes `quarantine(attacker_controlled_path)`. 4. The fun ...[truncated 1034 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
lawskillshield scan-local /path/to/skill clawskillshield quarantine /path/to/skill
text ### Python API (Agents) ```python from clawskillshield import scan_local, quarantine threats = scan_local("/path/to/skill") if risk_score < 4: # HIGH RISK quarantine("/path/to/skill")Zero Dependencies
Pure Python. No network calls. Runs entirely locally.
Why This Matters
ClawHavoc demonstrated how easily malicious skills can slip into the ecosystem. ClawSkillShield provides a trusted, open-source defense layer—audit the code, run offline, stay safe.
GitHub: https://github.com/AbYousef739/clawskillshield
License: MIT
Author: Ab Yousef
Contact: contact@clawskillshield.com
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # ClawSkillShield v0.1.1 **Local-first security scanner for OpenClaw/ClawHub skills built for BOTH humans AND autonomous agents/Moltbots.**
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function and returned message explicitly frame a destructive filesystem move as 'safe for agents to auto-trigger,' which encourages autonomous execution of a sensitive action without human validation. In an agent context, this materially increases the chance of unintended disruption, denial of service, or movement of important user files based on imperfect analysis results.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quarantine routine deletes any existing target directory and then moves the provided path without confirmation, rollback, or strong path validation. If invoked on an attacker-influenced or mistaken path, it can destroy data at the destination and remove access to legitimate files, especially dangerous when exposed to autonomous agents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly encourages autonomous agents to call quarantine() automatically when a risk threshold is met and labels this as 'Safe for agents to auto-trigger,' but it does not clearly warn that quarantine may move or alter local files. In an agent setting, that omission can lead to unintended file manipulation, disruption of workflows, or abuse if the scanner misclassifies a target.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly advertises automatic quarantine of local skills but provides no warning that this can autonomously modify, move, or disable files on the user's system. In an agent-executed context, that side effect can be disruptive and may cause denial of access to legitimate skills or unintended workflow interruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quick-start command presents
clawskillshield quarantine /path/to/skillas a normal first-use action without any caution about filesystem side effects. Users may execute it without understanding that it can alter local skill state, which is risky for a tool positioned as a safety utility.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The agent API example encourages autonomous quarantine of local content without warning about automatic modification by an agent. In addition, the example uses a suspicious/inverted threshold (
risk_score < 4labeled HIGH RISK), which could cause quarantining low-risk skills or signal poor safety design around an autonomous action.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
scan_local recursively traverses all matching files under a user-supplied path, which can access large portions of the local filesystem. The current docstring describes automation use but does not warn users or agents about the breadth of local file access or scanning scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The risk verdict mapping is inverted relative to the numeric score: higher scores are labeled LOW RISK while lower scores are labeled HIGH RISK. This can cause users or agents to trust dangerous skills and quarantine safer ones, directly undermining the security purpose of the tool.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level docstring presents the analyzer as broadly 'safe for humans and agents alike' with 'zero deps, no execution'. While it does avoid executing analyzed code, it still performs filesystem access by opening arbitrary paths and includes OS-level capability via an os import. That documentation overstates the absence of side effects/capabilities and can mislead about what the module actually does.
- Content
Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The build dependency is specified as setuptools>=61.0 without an upper bound or exact pin, so installs may resolve to different setuptools versions depending on environment and time. Because multiple setuptools releases have known advisories, this creates supply-chain uncertainty and can expose users or build systems to vulnerable versions if dependency resolution selects an affected release.
- Content
Static analysis
No suspicious patterns detected.