Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it handles secrets through a public Cloudflare tunnel and has web-form injection flaws that could expose a submitted secret if invocation inputs are manipulated.
Install only if you are comfortable sending secrets through a temporary Cloudflare-managed tunnel and you trust the agent invocation to choose the exact config key and label. Until fixed, avoid using it for high-value credentials; the form should escape all dynamic HTML, validate config keys, hide raw subprocess errors, and clearly warn users about Cloudflare tunnel transit.
Your value will be saved immediately and this server will shut down automatically. Nothing is stored in chat history.
Save
Config path: {config_key}
"""
```
A second unescaped HTML sink exposes subprocess error output:
```python
self._respond(500, f"
Save failed
text
{result.stderr}
")
```
### Technical Analysis
The server constructs HTML using Python f-strings and inserts `label` and `config_key` directly into markup without contextual HTML escaping. Both values originate from comm
...[truncated 3238 chars]
Remediation
View remediation
`, `"`, `'`, and `&`. Verify that they are rendered as text and cannot create elements, attributes, or scripts.
]]>
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs use of capabilities including shell execution, local file reads/writes, network access, and environment/config manipulation, but declares no explicit tool scope or permission boundaries. In a secret-handling skill, this is dangerous because the agent may invoke more privileges than necessary, making accidental secret exposure, config tampering, or unintended network transmission harder to constrain or audit.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill presents the flow as 'secure' but does not prominently warn users that secrets are transmitted through a Cloudflare Quick Tunnel, meaning the value leaves the local machine and traverses third-party infrastructure. This omission can mislead users into believing the process is equivalent to purely local secret entry, reducing informed consent around confidentiality and trust boundaries.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
Active tunnel info is recorded in `workspace/TUNNELS.md`.
The agent reads this file to check currently open tunnel URLs.
Entries are automatically removed when the server shuts down.
## Security
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · scripts/secret_server.py (reported line 53)May include surrounding context.
python
def update_tunnels_md(action: str, service: str, port: int, url: str, token: str, label: str):
"""Add or remove tunnel info from TUNNELS.md."""
if not TUNNELS_MD.exists():
TUNNELS_MD.write_text("# TUNNELS.md — Active Tunnels\n\nActive Cloudflare tunnels managed by the agent.\nAutomatically removed on server shutdown.\n\n| Service | Port | URL | Description |\n|---------|------|-----|-------------|\n")
content = TUNNELS_MD.read_text()
subprocess module call
Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content
Scanner excerpt · scripts/secret_server.py (reported line 70)May include surrounding context.
python
def start_cloudflare_tunnel(port: int) -> tuple[subprocess.Popen, str]:
"""Start a cloudflared tunnel and return the public URL."""
proc = subprocess.Popen(
["cloudflared", "tunnel", "--url", f"http://localhost:{port}"],
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill’s core design sends user secrets through a Cloudflare Tunnel to an internet-reachable endpoint, yet the UI text says only that the value is not stored in chat history and does not clearly warn that a third party proxies the secret. In this context, that is materially dangerous because the skill is specifically marketed for API keys, tokens, and passwords, so users may assume purely local handling when their secrets are actually transmitted through external infrastructure.
Content
No source excerpt is available for this finding.
subprocess module call
Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content
Scanner excerpt · scripts/secret_server.py (reported line 146)May include surrounding context.
python
body = urllib.parse.parse_qs(self.rfile.read(length).decode())
value = body.get("value", [""])[0].strip()
if value:
result = subprocess.run(
["openclaw", "config", "set", config_key, value],
capture_output=True, text=True
)
Vague Triggers
Low
Category
Not specified by scanner
Confidence
89% confidence
Finding
The description says to use the skill when registering API keys, tokens, passwords, or any sensitive config values, but it does not define explicit trigger phrases, constraints, or exclusion cases. This broad wording could overlap with many generic secret-handling situations and makes it unclear when this skill should be invoked instead of other configuration workflows.
