ClawHub
Back to skill

Security audit

Openclaw Magika

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local file-type detector, but its install instructions include an unsafe command that downloads a remote script and runs it immediately.

Review before installing. The skill itself appears to run Magika locally and does not request credentials, but avoid the `curl ... | sh` installer. Prefer an isolated package-manager install such as `pipx install magika` from a trusted source, and use recursive scans only on directories you intend to classify.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unpinned Remote Installation Script Is Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-59
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Complete Code Snippet:

bash
# curl script
curl -LsSf https://securityresearch.google/magika/install.sh | sh

Technical Analysis

The installation instructions retrieve a mutable shell script from an external URL and immediately pass the response to sh. The user has no opportunity to inspect the downloaded content, and the command does not pin a version or verify a cryptographic checksum or signature.

HTTPS authenticates the serving endpoint under the applicable DNS and certificate trust assumptions, but it does not ensure that the script remains identical to the version considered during this audit. The effective payload can therefore change after publication. The -s flag also suppresses normal transfer output, reducing visibility during installation.

This behavior exceeds the minimum privileges and capabilities necessary for the Skill's declared file-classification functionality. The Skill only needs an installed local magika executable, and package-manager installation alternatives are already documented.

Attack Path

  1. A user follows the documented curl-based installation instructions.
  2. curl requests the current contents of https://securityresearch.google/magika/install.sh.
  3. The remote endpoint, its hosting environment, DNS resolution, or another relevant supply-chain component is compromised, or the hosted script is otherwise changed maliciously.
  4. The malicious response is streamed directly into sh without local inspection or integrity verification.
  5. The supplied commands execute with the privileges of the user running the installation command.

Impact Assessment

A malicious response could execute arbitrary shell commands with the invoking user's privileges. Depending on those privileges and the host configura ...[truncated 512 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the pipe-to-shell installation option because it is unnecessary when package-manager alternatives are available.
  • Prefer a trusted package manager and pin the dependency to a reviewed version.
  • If a remote installation script must be retained:
    1. Reference an immutable, versioned release artifact.
    2. Download the script to a local file rather than piping it into a shell.
    3. Publish and verify a cryptographic checksum or trusted signature.
    4. Instruct the user to inspect the script before execution.
    5. Execute it as a separate, explicit step without elevated privileges.
  • Avoid quiet download flags in security-sensitive installation instructions so failures and source details remain visible.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Dependency Installation Instructions Do Not Pin an Approved Version

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-56
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
# pipx (recommended)
pipx install magika

# pip
pip install magika

# brew
brew install magika

Technical Analysis

Each installation command resolves the dependency version at installation time. Consequently, users may install a future package version whose contents differ from the version reviewed or expected by the Skill author.

The commands use the expected package name and standard package managers; the audited files contain no evidence of typosquatting, dependency confusion, or a known malicious package. The risk instead arises from absent version pinning and integrity controls, which leave installation dependent on mutable package repositories and their supply chains.

Attack Path

  1. A user runs one of the documented package-manager commands.
  2. The package manager resolves the currently available magika package or formula rather than a specifically reviewed release.
  3. A compromised repository, maintainer account, release process, or future malicious release provides altered package contents.
  4. The package manager downloads and installs that content.
  5. Malicious installation hooks or runtime code execute with the permissions available to the package manager or user.

Impact Assessment

Exploitation could result in execution of arbitrary dependency-supplied code during installation or when the magika executable is later invoked. The resulting scope is generally limited to the invoking user's permissions, but it can be broader if installation occurs in an elevated or system-wide package-management context.

No actual malicious dependency content was present in the audited project, so this finding represents a supply-chain hardening weakness rather than evidence that the named dependency is malicious.

Remediation
View remediation

Remediation Suggestions

  • Pin magika to a specific reviewed release in installation examples.
  • For Python installation, use an exact version constraint and verified hashes where supported.
  • Maintain a lockfile or equivalent reproducible dependency manifest for managed deployments.
  • For Homebrew, document an approved formula version or controlled installation method where practical.
  • Periodically review and deliberately update the pinned version after checking release provenance and security advisories.
  • Avoid recommending elevated or system-wide installation when an isolated per-user environment such as pipx is sufficient.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This finding is a true positive because the skill explicitly fetches an external script from the internet and presents it as an installation command. In a skill consumed by agents or users, this is especially dangerous because it normalizes running unreviewed remote code and can result in full compromise if the fetched content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

brew

brew install magika

curl script

curl -LsSf https://securityresearch.google/magika/install.sh | sh

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping directly into sh removes any review step and turns downloaded content into immediate code execution. In the context of an agent skill, this is more dangerous than a generic docs example because the skill may influence automated or semi-automated workflows, increasing the chance that unsafe installation commands are copied or executed without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

brew install magika

curl script

curl -LsSf https://securityresearch.google/magika/install.sh | sh

text

## Notes

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill includes a one-line installer that downloads a remote script and immediately executes it via the shell, without any integrity verification, pinning, or safety warning. This creates a supply-chain execution path where a compromised server, DNS/TLS interception, or modified script could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.