ClawHub
Back to skill

Security audit

virustotal

Security checks for vulnerabilities and agentic risk

Overview

This VirusTotal skill is mostly coherent and transparent, but its documented credential-loading pattern can execute local shell code from the secrets file and has avoidable API-key exposure risk.

Review before installing. The VirusTotal behavior and third-party sharing warnings are clear, but the credential instructions should be tightened: do not source an arbitrary secrets file as shell code, prefer a native secret store or strict parser for VIRUSTOTAL_API_KEY, and avoid temporary files containing API keys unless cleanup is unconditional.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:33
Finding

Arbitrary Shell Execution Through Sourced Credential File

Content
View full analysis
"$_H" \ && curl -s "https://www.virustotal.com/api/v3{PATH}" -H@"$_H" \ && rm -f "$_H" ``` ### Technical Analysis The shell dot command does not parse the target as a passive environment-data file. It executes every command in that file in the context of the current shell. Consequently, a credential file containing additional shell statements can execute arbitrary commands with the privileges of the agent or user invoking the Skill. The `VIRUSTOTAL_SECRETS_FILE` environment variable also allows the source path to be redirected. If an attacker can influence that variable, modify the expected credentials file, or cause the agent to use an untrusted workspace configuration, the attacker can turn a routine VirusTotal query into local command execution. Executing an entire shell file exceeds the minimum privilege necessary for the declared functionality, which only requires retrieving one API-key value. ### Attack Path 1. An attacker modifies `~/.openclaw/secrets/virustotal.env` or causes `VIRUSTOTAL_SECRETS_FILE` to reference an attacker-controlled file. 2. The malicious file contains a valid-looking API-key assignment followed by arbitrary shell commands. 3. A user asks the agent to perform a VirusTotal operation. 4. The agent follows the documented request pattern and sources the file. 5. The attacker's commands execute before the VirusTotal API request, using the invoking agent's operating-system privi ...[truncated 808 chars]
Remediation
View remediation
` and never evaluates its contents as shell syntax. - Reject duplicate keys, command substitutions, shell metacharacters, additional directives, and unexpected lines. - Resolve the credential path against an approved location rather than accepting an unrestricted environment-provided path. - Verify that the credential file is a regular file, is owned by the current user, is not a symbolic link, and has restrictive permissions such as `0600`. - Pass the parsed key directly to the HTTP client while ensuring that command tracing and diagnostic logs cannot expose it. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:99
Finding

VirusTotal API Key Persists in Temporary File When Request Fails

Content
View full analysis
"$_H" \ && curl -s "https://www.virustotal.com/api/v3{PATH}" -H@"$_H" \ && rm -f "$_H" ``` ### Technical Analysis The VirusTotal API key is written as a plaintext HTTP header into a temporary file. File permissions are changed to `0600`, which reduces exposure to other unprivileged users, but deletion occurs only after `curl` returns successfully because the commands are joined with `&&`. If `curl` fails because of a network outage, TLS failure, invalid arguments, termination, or another nonzero exit condition, execution stops before `rm -f "$_H"`. Interrupting the shell can have the same effect. The plaintext header file can consequently remain in the temporary directory indefinitely. This is an unsafe temporary-secret lifecycle. Restrictive permissions do not provide secure deletion or guarantee cleanup, and same-user or privileged processes may still read the retained credential. ### Attack Path 1. A user initiates a VirusTotal request through the Skill. 2. The request pattern creates a temporary file and writes the plaintext `x-apikey` header into it. 3. The `curl` operation fails or is interrupted before returning a successful status. 4. Because cleanup is chained after `curl` with `&&`, the removal command is skipped. 5. A process running as the same user, or a privileged local process, identifies and reads the surviving temporary file. 6. The recovered API key is reused to access VirusTotal under the victim's account and consume its quota or available account permissions. This exploitation path requires local access as the same user or a more privileged account. The file's `0600` mode prevents ordinary cross-user access but does not eliminate secret-retention risk. ...[truncated 507 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (8)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
- `VIRUSTOTAL_API_KEY=xxx curl ...`
- Any form of reading secrets into tool output

**If credential loading fails:** Fix the secrets file path or contents. Do NOT bypass security by hardcoding values.

## ⚠️ Privacy & Data Sharing

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
isplay secrets in tool output.** The `.` source command loads credentials into shell variables silently — no output is produced. This is the correct and secure approach.

**Banned patterns:**
- `cat ~/.openclaw/secrets/virustotal.env`
- `VIRUSTOTAL_API_KEY=xxx curl ...`
- Any form of reading secrets into tool output

**If credential loading fails:** Fix the secrets file path or contents. Do NOT bypass security by hardcoding values.

## ⚠️ Privacy & Data Sharing

**Any file, URL, domain, or IP submitted to VirusTotal may be shared with VirusTotal's security partners and could become accessible to third parties beyond your control.**

Before submitting:
- **Files:** Prefer hash-based lookups (SHA256/MD5/SHA1) over uploads for sensitive or proprietary files
- **URLs:** Consider whether internal/private URLs should be sent to a third party
- **IPs/Domains:** Be aware these queries reveal your infrastructure interests to VirusTotal
- **Never upload** proprietary binaries, confidential

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

&& _H=$(mktemp) && chmod 600 "$_H"
&& printf 'x-apikey: %s\n' "$VIRUSTOTAL_API_KEY" > "$_H"
&& curl -s "https://www.virustotal.com/api/v3{PATH}" -H@"$_H"
&& rm -f "$_H"

text

**For POST requests** add `-X POST` and appropriate data flags after the URL.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

Setup

  1. Get your free API key from https://www.virustotal.com/gui/my-apikey
  2. Create the secrets file:
    bash
    mkdir -p ~/.openclaw/secrets
echo 'VIRUSTOTAL_API_KEY=your_key_here' > ~/.openclaw/secrets/virustotal.env

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash
   mkdir -p ~/.openclaw/secrets
   echo 'VIRUSTOTAL_API_KEY=your_key_here' > ~/.openclaw/secrets/virustotal.env
   chmod 600 ~/.openclaw/secrets/virustotal.env
  1. Install the skill (see Agent Integration below)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash
   mkdir -p ~/.openclaw/secrets
   echo 'VIRUSTOTAL_API_KEY=your_key_here' > ~/.openclaw/secrets/virustotal.env
   chmod 600 ~/.openclaw/secrets/virustotal.env
  1. Install the skill (see Agent Integration below)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bash
   mkdir -p ~/.openclaw/secrets
   echo 'VIRUSTOTAL_API_KEY=your_key_here' > ~/.openclaw/secrets/virustotal.env
   chmod 600 ~/.openclaw/secrets/virustotal.env
  1. Install the skill (see Agent Integration below)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

text
VIRUSTOTAL_API_KEY=your_api_key_here

Create with chmod 600. Get your API key from https://www.virustotal.com/gui/my-apikey.

Loading: All curl examples use . (dot) source to load credentials into the shell environment:

bash