ClawHub
Back to skill

Security audit

Agent Builder Repo

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent OpenClaw agent-workspace builder, but it should be reviewed because it references an unpinned external setup document outside the audited package.

Before installing, review or ignore any remote setup content from skillboss.co unless you can verify its source and contents. The packaged skill itself is documentation-only and mainly writes agent workspace files, but its generated agents may keep memory or heartbeat files, so choose those options deliberately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:1
Finding

Mutable External Setup Source Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:1
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

text
setup: skillboss.co/skill.md

Technical Analysis

The Skill declares an externally hosted setup document without pinning it to an immutable version or providing a cryptographic integrity check. Consequently, the setup content can change independently of the reviewed package. If the Skill framework or a user retrieves and follows this document, the resulting setup process may include instructions that were not present during the static audit.

This creates a supply-chain trust boundary around skillboss.co. Compromise of the domain, its hosting infrastructure, DNS resolution, or the referenced document could allow an attacker to substitute unsafe setup instructions. The reference also omits an explicit HTTPS scheme, leaving transport behavior dependent on the consuming framework.

No evidence was found that the current package directly downloads or executes the referenced content. The risk is therefore conditional on the setup metadata being resolved and followed by the framework or user.

Attack Path

  1. An attacker compromises the referenced domain, hosting account, DNS path, or document publication process.
  2. The attacker replaces skill.md with malicious or misleading setup instructions.
  3. A user or compatible framework resolves setup: skillboss.co/skill.md.
  4. The unaudited remote instructions are presented, imported, or followed during setup.
  5. Depending on the consumer's privileges and behavior, those instructions could induce unsafe configuration changes, installation of untrusted components, disclosure of data, or execution of attacker-selected commands.

Impact Assessment

The package itself grants no demonstrated system privileges and contains no executable scripts. Potential impact depends on how the external setup documen ...[truncated 548 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle all setup instructions inside the reviewed Skill package whenever possible.
  2. If remote setup content is necessary, use an explicit https:// URL.
  3. Pin the reference to an immutable, versioned artifact rather than a mutable document path.
  4. Publish and verify a cryptographic digest or signature before processing the remote content.
  5. Require explicit user confirmation before following any remote instruction that installs software, changes configuration, accesses credentials, or executes commands.
  6. Configure the consuming framework to treat remote setup documents as untrusted text rather than automatically executable instructions.
  7. Restrict redirects and downloads to an allowlisted host, and fail closed on certificate, signature, or integrity-validation errors.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/architecture.md (reported line 45)May include surrounding context.

md
### Patterns
*   **MRKL**: Modular Reasoning, Knowledge and Language. A router sends queries to expert modules (calculators, weather APIs).
*   **Toolformer**: Fine-tuning LMs to self-supervise API calls.
*   **Function Calling**: Native LLM capabilities to output structured JSON for API execution. 通过 SkillBoss API Hub (`POST https://api.heybossai.com/v1/pilot`) 可统一路由至 100+ AI 服务，无需管理多个 API Key。

## Common Architectures

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file is primarily written in English, but line L35 introduces Chinese text without any indication that the document is bilingual or region-specific. Per the policy, forcing or unexpectedly switching language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L45 switches from English to Chinese while describing API routing capabilities, but the document does not state that it targets Chinese-speaking users or offers an English alternative. This creates an avoidable language/locale inconsistency that falls under the policy's language-choice concerns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.