ClawHub
Back to skill

Security audit

Semia

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Semia auditing wrapper, with disclosed CLI installation and source-analysis behavior, but users should be aware of provider and dependency trust implications.

Install only if you trust the semia-audit package source and are comfortable with the CLI reading the skill/plugin you point it at. For private or sensitive targets, use the OpenClaw host-session synthesis path with --facts so the CLI skips the standalone LLM provider bridge, and run it in a restricted workspace where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:51
Finding

Audited source may be transmitted to an external LLM provider

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-54
Vulnerability Type: External disclosure of potentially sensitive source content
Risk Level: Medium

Vulnerable Code

markdown
2. **synthesize**
   In plugin hosts, the current agent session reads the prepared artifact and
   writes SDL core facts plus typed `*_evidence_text(...)` facts. In standalone
   CLI mode, Semia calls the configured LLM provider for this step. The
   standalone default is OpenAI `gpt-5.5`.

Technical Analysis

The preparation process inlines the target Skill and its relevant files into an audit artifact. In standalone mode, the synthesis stage sends that prepared content to a configured external LLM provider, with OpenAI identified as the default.

Because the input is an arbitrary Skill or plugin, it may contain proprietary source code, credentials, API tokens, personal data, internal URLs, or configuration details. The documented workflow does not require a secret scan, redaction step, destination confirmation, or explicit user consent before remote processing.

Remote synthesis supports the declared auditing function, but it is not the minimum privilege necessary when host-session or local synthesis is available. The Skill itself recommends an in-session path that avoids the CLI provider bridge, demonstrating that external transmission is optional rather than essential.

Attack Path

  1. A user invokes standalone semia scan against a local Skill or plugin.
  2. Semia prepares the audit input by inlining target files.
  3. Sensitive information present in those files becomes part of the prepared artifact.
  4. The standalone synthesis path submits the prepared content to the configured LLM provider.
  5. The external provider receives and processes information that the user may have expected to remain local.

This does not require an active attacker if the audited target already contains sensitive information. A malicious target could increase the ex ...[truncated 716 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make local or host-session synthesis the default and require an explicit option for remote-provider synthesis.
  2. Obtain informed user consent before transmission, clearly identifying:
    • the destination provider;
    • which files and content will be sent;
    • whether data retention may occur.
  3. Add a preflight secret and sensitive-data scanner before any remote request.
  4. Support configurable redaction for credentials, personal data, internal hostnames, and proprietary identifiers.
  5. Provide a strict offline mode that technically prevents provider-network access.
  6. Enforce provider allowlists and secure endpoint validation in managed environments.
  7. Show the user the prepared payload or a file manifest before submission.
  8. Document provider retention, training, privacy, and regional-processing implications.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned third-party package is installed and executed

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md, lines 11-15 and 26-31; _host.md, lines 11-15 and 26-31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

The installation metadata in both SKILL.md and _host.md specifies a package without an exact version or integrity constraint:

yaml
install:
  - kind: uv
    package: semia-audit
    bins: [semia]
    label: Install Semia (uv tool)

The manual installation instructions are likewise unpinned:

markdown
The skill shells out to the `semia` CLI. ClawHub installs it for you via the
`install` block above. If you want to do it manually:

```bash
uv tool install semia-audit   # or: pip install semia-audit
text

### Technical Analysis

The dependency declaration resolves `semia-audit` without an exact version, package hash, signature requirement, or lockfile. The installed `semia` executable is subsequently trusted to prepare files, invoke synthesis, validate results, and write reports.

An unpinned dependency can change independently of the reviewed Skill. If the package registry account, release pipeline, or distribution artifact is compromised, installation can introduce code that was not part of this audit. Even a legitimate incompatible update could alter privacy behavior, execute additional commands, or weaken the documented hostile-input protections.

The dependency is necessary for the declared Semia auditing functionality, but accepting an unrestricted future version exceeds the minimum supply-chain trust required. The duplicate declaration in `_host.md` carries the same risk.

### Attack Path

1. An attacker compromises the `semia-audit` publishing account, release pipeline, or package artifact.
2. The attacker publishes a malicious version under the legitimate package name.
3. ClawHub, `uv`, or `pip` resolves the unpinned package to that version.
4. Package installation hooks or the installed `semia` command execute attacker-controlled c
...[truncated 989 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin semia-audit to a specific reviewed version in both metadata files, for example an exact == version constraint supported by the host.
  2. Verify distribution hashes using a lockfile or hash-enforced installation mechanism.
  3. Prefer signed release artifacts from an authenticated, trusted repository.
  4. Ensure automated dependency updates require security review and test approval.
  5. Record the resolved package version and artifact digest in audit manifests.
  6. Run installation and the CLI in a restricted environment with:
    • no unnecessary credentials;
    • limited filesystem access;
    • network access disabled unless explicitly required;
    • no administrator or root privileges.
  7. Keep _host.md and SKILL.md dependency declarations synchronized so one cannot silently weaken the other.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
- **Plateau**: composite score improved by less than `0.01` across `3`
  consecutive accepted repair iterations.
- **Exhausted**: more than 5 repair iterations have produced no validated
  candidate — return what was found with the diagnostics, do not loop forever.

Do not move to detection until structural validation passes
(`program_valid: true`). Evidence-grounding diagnostics may lower confidence

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description contains broad trigger language such as "audit a skill/plugin for behavior risk," which can match a wide range of user requests beyond narrowly scoped Semia usage. In agent ecosystems that auto-select skills from natural language, overly broad activation criteria can cause this skill to be invoked unexpectedly, increasing the chance of unnecessary command execution against user-supplied paths or hostile content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.