T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scope_engagement.py:12- Finding
Client Data Stored Without Enforced Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Consulting
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned and has no evidence of exfiltration, but it stores confidential client engagement data locally without enforcing restrictive file protections.
Review this skill before installing if you plan to store real client names or sensitive engagement details. Its behavior is locally scoped and does not show network sharing, but the stored consulting records may inherit permissive filesystem permissions unless the environment already enforces private ~/.openclaw directories and files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes concrete file read/write behavior via local memory files and script usage, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader filesystem access than the skill metadata communicates, increasing the chance of unintended access to sensitive client data or modification of local state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation description is broad enough to activate on common business terms like proposals, pricing, deliverables, or client relationships, which can cause the skill to run in loosely related contexts. In a skill with file read/write capabilities and local client-data handling, over-broad triggering increases the risk of unnecessary access to sensitive engagement information or actions being taken when a more constrained skill should handle the request.
- Content
Static analysis
No suspicious patterns detected.