Security audit

Ai Reach Kit

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a marketing and publishing kit, but it includes under-scoped public publishing automation and a persistent daily bounty-check instruction that users should review carefully.

Install only if you specifically want a promotional kit for OpenClaw skills. Review the publish script before running it, confirm exactly which folder and ClawHub account it will publish to, and avoid adding the HEARTBEAT.md daily task unless you intentionally want recurring bounty checks and know how to remove them.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

Location: guides/bounty-hunters.md:16
Finding: Persistent Autonomous Bounty Monitoring Through HEARTBEAT.md<![CDATA[ ## Vulnerability Details **File Location**: `guides/bounty-hunters.md`, lines 16-21 **Vulnerability Type**: Persistent scheduled agent instruction **Risk Level**: Medium ### Vulnerable Code ```markdown ## 3. Pro Hunt (Cron) Edit `HEARTBEAT.md`: ``` Check ClawBounty open issues daily. ``` Hunt GH issues: `/gh-issues achilles/openclaw --label bounty` ``` ### Technical Analysis The guide instructs users to add a recurring task to `HEARTBEAT.md`. In an agent environment where this file controls periodic behavior, the instruction survives the current Skill invocation and causes the agent to perform daily bounty reconnaissance. This changes persistent agent state rather than providing a one-time, user-triggered command. The recurring instruction does not define an expiration date, resource limits, approved repositories, notification requirements, or a requirement to obtain confirmation before taking follow-up action. The behavior requires the user to follow the guide; the project does not silently edit `HEARTBEAT.md`. Nevertheless, the documented workflow establishes cross-session persistence and therefore matches `T06: System Persistence`. ### Attack Path 1. A user installs the Skill and follows the “Pro Hunt (Cron)” instructions. 2. The user or agent writes `Check ClawBounty open issues daily.` into `HEARTBEAT.md`. 3. The host agent reads the persistent heartbeat configuration during later sessions. 4. The agent repeatedly queries bounty or GitHub issue sources without a fresh request for each run. 5. If later automation acts on results, the persistent task may trigger additional external operations under the user’s existing agent and service permissions. ### Impact Assessment The persistent instruction can consume recurring compute, network, API-rate-limit, and agent resources. It may repeatedly access external bounty services and GitHub using the permissions already available to the host agent. No privilege escalation or credential theft is ...[truncated 173 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to modify `HEARTBEAT.md` and make bounty discovery an explicitly user-triggered operation. - If recurring checks are a required feature, obtain informed opt-in before changing persistent state. - Define the exact repositories, services, frequency, maximum runtime, and network operations permitted for each check. - Add an expiration date or bounded execution count. - Require explicit user approval before claiming a bounty, modifying a repository, opening a pull request, publishing content, or initiating any payment-related action. - Document the exact procedure for disabling the task and removing the heartbeat entry. - Record each scheduled execution in an auditable log and notify the user when it runs. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish-to-clawhub.sh:4
Finding: Unsafe Shell Expansion and CLI Option Injection in Publishing Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/publish-to-clawhub.sh`, lines 4-15 **Vulnerability Type**: Shell argument splitting, pathname expansion, and option injection **Risk Level**: Medium ### Vulnerable Code ```bash SKILL_DIR=$1 SLUG=${2:-$(basename $SKILL_DIR)} NAME=${3:-$SLUG} VERSION=${4:-1.0.0} CHANGELOG=${5:-\"Quick publish\"} if [ -z \"$SKILL_DIR\" ]; then echo \"Usage: $0 <skill-dir> [slug] [name] [version] [changelog]\" exit 1 fi cd $SKILL_DIR clawhub publish . --slug $SLUG --name \"$NAME\" --version $VERSION --changelog \"$CHANGELOG\" ``` ### Technical Analysis The script expands `SKILL_DIR`, `SLUG`, and `VERSION` without shell quoting. Unquoted variable expansions undergo word splitting and pathname expansion. Consequently: - A directory containing spaces can be split into multiple arguments to `cd` or `basename`. - Glob characters in supplied values can expand to local filenames. - A path beginning with a hyphen can be interpreted as an option unless option parsing is terminated with `--`. - A slug or version containing whitespace can become multiple arguments to `clawhub`. - Crafted additional words beginning with hyphens may be interpreted as unintended `clawhub` options, depending on the CLI parser. The script also prints a success message without checking whether `cd` or `clawhub publish` succeeded. Because `set -e` is not enabled and return values are not tested, a failed or misdirected publication can still be reported as successful. This evidence establishes argument and option injection risk. It does not, by itself, establish arbitrary shell-command execution because shell metacharacters introduced through ordinary variable expansion are not reparsed as shell syntax. ### Attack Path 1. An attacker or untrusted automation supplies a crafted skill directory, slug, or version to the publishing script. 2. The script expands the value without quotes. 3. The shell splits the value into multiple words or expan ...[truncated 891 chars]
Remediation: <![CDATA[ ## Remediation Suggestions Use strict error handling, quote every expansion, terminate option parsing where supported, and validate values before passing them to the publishing CLI. For example: ```bash #!/usr/bin/env bash set -euo pipefail if (( $# < 1 )); then printf 'Usage: %s <skill-dir> [slug] [name] [version] [changelog]\n' "$0" >&2 exit 1 fi SKILL_DIR=$1 SLUG=${2:-$(basename -- "$SKILL_DIR")} NAME=${3:-$SLUG} VERSION=${4:-1.0.0} CHANGELOG=${5:-Quick publish} [[ -d "$SKILL_DIR" ]] || { printf 'Invalid skill directory: %s\n' "$SKILL_DIR" >&2 exit 1 } [[ "$SLUG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || { printf 'Invalid slug\n' >&2 exit 1 } [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][A-Za-z0-9.-]+)?$ ]] || { printf 'Invalid version\n' >&2 exit 1 } cd -- "$SKILL_DIR" clawhub publish . \ --slug "$SLUG" \ --name "$NAME" \ --version "$VERSION" \ --changelog "$CHANGELOG" printf 'Published %s@%s\n' "$SLUG" "$VERSION" ``` Additionally: - Reject unexpected control characters and leading-hyphen values. - Confirm the canonical publication directory before invoking `clawhub`. - Review the actual `clawhub` CLI specification and use its end-of-options delimiter where supported. - Print success only after `clawhub publish` returns a successful exit status. - Consider an interactive confirmation showing the resolved directory, slug, name, and version before publication. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 77% confidence
Finding: This markdown/manifest content describes the skill in very broad terms such as 'Perfect for OpenClaw builders scaling reach & revenue' and 'Unzip → customize → ship → monetize!' without specifying narrow invocation conditions or exclusions. Such unspecific positioning can make it unclear when the skill should be used versus not used, increasing the risk of unintended activation in marketing or publishing contexts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation explicitly encourages running a '1-click' publish script against a user-supplied skill folder without explaining what remote actions, repository changes, credential use, or publishing side effects may occur. In a security-sensitive agent ecosystem, normalizing execution of opaque deployment scripts increases the chance of unintended publication, data exposure, or supply-chain abuse, especially because the referenced ZIP and script contents are not visible here.

Static analysis

No suspicious patterns detected.