T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:46- Finding
Shell Command Injection Through an Unquoted User-Controlled Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Family Grocery List
Security checks for vulnerabilities and agentic risk
Overview
This grocery-list skill appears purpose-aligned, but it needs review because setup can write to a user-chosen local path and its shared-file access controls are weak.
Review before installing. Use only a dedicated, non-sensitive shared folder, avoid paths containing shell metacharacters, and do not rely on this skill for strong access control. Family members with filesystem access may be able to read or modify the underlying files directly, including membership and history data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:46- Finding
Unrestricted Filesystem Destination Enables Arbitrary File Creation or Overwrite
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:29- Finding
Mutable Name-Based Identity Allows User Impersonation and Unsafe Administrator Bootstrap
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:17- Finding
Authorization Database Resides in the Shared Data Directory Without Integrity Protection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to create directories and initialize files on the local filesystem during first-time setup, but it provides no explicit user-confirmation or safety checks around path selection, overwrite behavior, or existing content. Because the path is user-provided and then persisted for later use, this creates a real risk of unintended filesystem modification, especially if the path is mistyped, points to a sensitive location, or already contains unrelated files.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Never cache across sessions. Always re-read `config.json` and `users.md` at startup to pick up changes made by other family members. ### 2. Identity is resolved from OpenClaw memory - Never ask the user for their name — always read it from the agent's OpenClaw memory. If absent, deny access. - Never ask for the shared path if it's in memory. - Save both on first encounter so they're never asked again. - Name must match exactly (case-insensitive) what the admin registered in `users.md`.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger set includes very broad everyday phrases such as "Show the list," which can easily match ordinary conversation outside a clear grocery-management intent. In an always-on or loosely scoped agent environment, this can cause unintended disclosure of the family grocery list and store/address details or trigger actions in the wrong context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documentation introduces persistent store-configuration administration features such as setting a primary store, fallback order, and category-to-store mappings, which go beyond the stated grocery-list scope. Expanding capabilities beyond the manifest increases the attack surface and can enable unauthorized or unexpected configuration changes if the surrounding authorization and review mechanisms are weaker than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The setup flow performs persistent side effects by creating directories/files and automatically assigning the first user as admin, but it does not require an explicit confirmation step or clearly warn the user that these changes are durable and security-relevant. In a shared-path, multi-user skill, accidental initialization could let the wrong person permanently claim admin control or modify a shared data location without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The removal workflow immediately deletes a user's entry after a trigger phrase, without an explicit confirmation or warning that access will be revoked. This increases the chance of accidental or socially engineered user removal in a shared family system, causing unintended denial of access and administrative mistakes.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L61 states the skill 'will not ask' for the user name and that the key must already be set before first use. But L68 says that when connecting as a member, the skill saves the path, 'asks for username if not already stored,' and then verifies it against users.md. These instructions describe conflicting runtime behavior.
- Content