T06 · System Persistence
Warning
- Location
guides/bounty-hunters.md:16- Finding
Persistent Autonomous Bounty Monitoring Through HEARTBEAT.md
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Reach Kit
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a marketing and publishing kit, but it includes under-scoped public publishing automation and a persistent daily bounty-check instruction that users should review carefully.
Install only if you specifically want a promotional kit for OpenClaw skills. Review the publish script before running it, confirm exactly which folder and ClawHub account it will publish to, and avoid adding the HEARTBEAT.md daily task unless you intentionally want recurring bounty checks and know how to remove them.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/publish-to-clawhub.sh:4- Finding
Unsafe Shell Expansion and CLI Option Injection in Publishing Script
- Content
View full analysis
[slug] [name] [version] [changelog]\" exit 1 fi cd $SKILL_DIR clawhub publish . --slug $SLUG --name \"$NAME\" --version $VERSION --changelog \"$CHANGELOG\" ``` ### Technical Analysis The script expands `SKILL_DIR`, `SLUG`, and `VERSION` without shell quoting. Unquoted variable expansions undergo word splitting and pathname expansion. Consequently: - A directory containing spaces can be split into multiple arguments to `cd` or `basename`. - Glob characters in supplied values can expand to local filenames. - A path beginning with a hyphen can be interpreted as an option unless option parsing is terminated with `--`. - A slug or version containing whitespace can become multiple arguments to `clawhub`. - Crafted additional words beginning with hyphens may be interpreted as unintended `clawhub` options, depending on the CLI parser. The script also prints a success message without checking whether `cd` or `clawhub publish` succeeded. Because `set -e` is not enabled and return values are not tested, a failed or misdirected publication can still be reported as successful. This evidence establishes argument and option injection risk. It does not, by itself, establish arbitrary shell-command execution because shell metacharacters introduced through ordinary variable expansion are not reparsed as shell syntax. ### Attack Path 1. An attacker or untrusted automation supplies a crafted skill directory, slug, or version to the publishing script. 2. The script expands the value without quotes. 3. The shell splits the value into multiple words or expan ...[truncated 891 chars]- Remediation
View remediation
[slug] [name] [version] [changelog]\n' "$0" >&2 exit 1 fi SKILL_DIR=$1 SLUG=${2:-$(basename -- "$SKILL_DIR")} NAME=${3:-$SLUG} VERSION=${4:-1.0.0} CHANGELOG=${5:-Quick publish} [[ -d "$SKILL_DIR" ]] || { printf 'Invalid skill directory: %s\n' "$SKILL_DIR" >&2 exit 1 } [[ "$SLUG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || { printf 'Invalid slug\n' >&2 exit 1 } [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][A-Za-z0-9.-]+)?$ ]] || { printf 'Invalid version\n' >&2 exit 1 } cd -- "$SKILL_DIR" clawhub publish . \ --slug "$SLUG" \ --name "$NAME" \ --version "$VERSION" \ --changelog "$CHANGELOG" printf 'Published %s@%s\n' "$SLUG" "$VERSION" ``` Additionally: - Reject unexpected control characters and leading-hyphen values. - Confirm the canonical publication directory before invoking `clawhub`. - Review the actual `clawhub` CLI specification and use its end-of-options delimiter where supported. - Print success only after `clawhub publish` returns a successful exit status. - Consider an interactive confirmation showing the resolved directory, slug, name, and version before publication. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This markdown/manifest content describes the skill in very broad terms such as 'Perfect for OpenClaw builders scaling reach & revenue' and 'Unzip → customize → ship → monetize!' without specifying narrow invocation conditions or exclusions. Such unspecific positioning can make it unclear when the skill should be used versus not used, increasing the risk of unintended activation in marketing or publishing contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly encourages running a '1-click' publish script against a user-supplied skill folder without explaining what remote actions, repository changes, credential use, or publishing side effects may occur. In a security-sensitive agent ecosystem, normalizing execution of opaque deployment scripts increases the chance of unintended publication, data exposure, or supply-chain abuse, especially because the referenced ZIP and script contents are not visible here.
- Content