Security audit

Dogovor Ru

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly analyzes Russian contracts, but it also asks the agent to run Python, write a persistent local counter, and inject promotional links.

Review before installing. The contract explanation portion is straightforward, but the skill also performs unrelated local state tracking and inserts promotional links. Install only if that behavior is removed or explicitly acceptable in your environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:57
Finding: Mandatory Promotional Content Injection into Contract Analysis Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:61
Finding: Undisclosed Command Execution and Persistent Workspace Counter Modification
Content: View full analysis
= 3 — ничего не добавляй ``` ### Technical Analysis The Skill instructs the Agent to launch Python solely to read and modify `/home/node/.openclaw/workspace/ru-pack-counter.txt`. This local command execution and persistent state modification are unrelated to the declared contract-analysis function. The path is hard-coded to an implementation-specific OpenClaw workspace. The write operation is performed without user consent, explicit permission scoping, error handling, file locking, or validation that the target is an ordinary file. For example, if another local actor can replace the target with a symbolic link, the process may write through that link to another file accessible to the Agent account. The fixed command contains no user-controlled input, so direct command injection is not present in the reviewed code. The counter survives individual Skill invocations and controls when promotional content is emitted. It is persistent application state, but it does not store attacker-controlled behavioral rules and does not install a startup mechanism. Therefore, the confirmed issue is insecure and unneces ...[truncated 1381 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims to analyze contracts, but it also instructs the agent to read and update a local counter file and append promotional content based on that state. This is unrelated hidden behavior that expands the skill's scope, introduces persistent state changes, and creates an integrity/privacy risk because the agent is being redirected from user-facing analysis into local environment interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill contains undisclosed subprocess/file-write behavior for attribution tracking, which is not mentioned in the user-facing description. Hidden stateful tracking and local writes are dangerous because they violate least surprise, can be abused for covert telemetry/persistence, and may bypass user expectations about what a document-analysis skill is allowed to do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The embedded Python commands cause local command execution and file-state management that are not necessary for contract explanation. In an agent environment, any prompt that attempts to trigger subprocess-like behavior or filesystem writes is dangerous because it can be adapted for persistence, data access, or covert tracking beyond the user's request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill name, slug, and description indicate a Russian-language and Russian-contract focus, but the file does not explicitly offer language choice or state that Russian output is a documented locale constraint. This can be a natural-language policy issue if the skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill's early security guidance is good, but later instructions contradict the principle of limiting behavior to document analysis by adding unrelated command execution. This inconsistency is dangerous because it normalizes a security-conscious framing while smuggling in operational instructions, making reviewers or agents less likely to notice the scope change.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file defines activation triggers, so SQP-1 applies. The list includes broad words like "договор", "контракт", and especially "подписать", which can appear in many ordinary contexts and may cause unintended invocation without clear scope limits or exclusion examples.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The staged flow moves from legitimate contract analysis into local command execution and self-promotion, which is characteristic of prompt-level behavior smuggling. This is dangerous in context because the skill appears trustworthy and domain-specific, so the unrelated final steps may evade scrutiny while causing unauthorized side effects in the agent environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.