T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Shell Command Injection Through Unsafe Prompt Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
claude-code-cli
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent for delegating coding work to Claude Code, but it teaches high-impact background execution patterns with broad edit authority and some unsafe shell-command examples.
Install only if you intentionally want OpenClaw to launch Claude Code with project-level coding authority. Use restricted tools and explicit work directories, avoid copying untrusted text directly into shell command strings, review HANDOFF.md before resuming, monitor or stop background sessions, verify temporary paths before cleanup, and consider pinning the Claude Code package version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:8- Finding
Unpinned Claude Code npm Dependency
- Content
View full analysis
- Remediation
View remediation
" ``` 2. Where the OpenClaw installation format permits it, record and verify the package's cryptographic integrity hash. 3. Use a lockfile or equivalent immutable dependency manifest for local installation workflows. 4. Review release notes and package provenance before updating the pinned version. 5. Automate dependency update proposals, but require security review and testing before accepting them. 6. Prefer registry and package-manager configurations that verify package signatures or provenance attestations. 7. Run installation and the resulting CLI with the minimum filesystem, credential, and network access required for the task. ]]>
Vulnerability Patterns
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
exec pty:true workdir:/tmp/pr-review command:"claude --permission-mode plan 'Review this PR. Focus on bugs, security issues, and performance. Show diff summary.'"
Clean up
exec command:"rm -rf /tmp/pr-review"
text ### Parallel Issue Fixing with Git Worktrees
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
exec pty:true workdir:/tmp/pr-review command:"claude --permission-mode plan 'Review this PR. Focus on bugs, security issues, and performance. Show diff summary.'"
Clean up
exec command:"rm -rf /tmp/pr-review"
text ### Parallel Issue Fixing with Git Worktrees
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
exec command:"gh pr create --repo user/repo --head fix/issue-78 --title 'fix: ...' --body '...'"
5. Cleanup
exec command:"git worktree remove /tmp/issue-78" exec command:"git worktree remove /tmp/issue-99"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Cleanup
exec command:"git worktree remove /tmp/issue-78" exec command:"git worktree remove /tmp/issue-99"
text ### Fan-Out Pattern (Bulk Operations)
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
HANDOFF.md Pattern (Long Sessions)
For tasks that exceed context limits, write progress to a handoff file:
bash # In the Claude Code session, ask it to write progress
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 73% confidence
- Finding
The skill recommends persisting session state into HANDOFF.md and then resuming work from that file in a fresh session. This can propagate untrusted or stale instructions across runs, preserve sensitive data in the repository, and make prompt-injection or workflow manipulation persist beyond the original session.
- Content
HANDOFF.md Pattern (Long Sessions)
For tasks that exceed context limits, write progress to a handoff file:
bash # In the Claude Code session, ask it to write progress
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown includes a recursive deletion command (
rm -rf /tmp/pr-review) as part of the workflow, but does not explicitly warn that it permanently deletes the checked-out review workspace. Although the section is generally framed as cleanup, the criteria call for warning users about behaviors that could affect user data or system integrity.- Content
Static analysis
No suspicious patterns detected.