ClawHub
Back to skill

Security audit

Linux installer

Security checks for vulnerabilities and agentic risk

Overview

This Linux app installer mostly matches its stated purpose, but it can install community-controlled AUR packages with reduced safeguards despite claiming unreviewed installs require stronger opt-in controls.

Review AUR behavior carefully before installing. This skill is appropriate only if you are comfortable with an agent running local package-manager commands, including sudo-backed installs/removals and service setup. Avoid using it for AUR packages until AUR candidates are always labeled community/unreviewed, require separate confirmation, and avoid --noconfirm.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
main.py:628
Finding

AUR Packages Bypass Unreviewed and Community Installation Safeguards

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this skill is for end-user app management on Linux: installing, launching, and uninstalling desktop apps after selecting the safest supported source. The supplied code does something materially different. It is a catalog validation utility that reads catalog.json, checks candidate package identifiers against various package manager commands, and outputs validation results. While it interacts with package-manager tooling, it never performs install/remove/launch actions, never accepts a user app request to resolve into commands, and never calls any helper CLI for desktop app management. This is a clear description-behavior mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The skill documents a deliberate bypass path for installing unreviewed community suggestions via --allow-unsafe, which can lead to execution of untrusted package sources on the host. Even with opt-in and confirmation, this normalizes a dangerous workflow in a high-impact context because package installation can run maintainer scripts, alter system state, and introduce malware or persistence.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
1. `skills.entries.linux-installer.unsafeCommunityInstalls` is enabled in `openclaw.json`
2. the user explicitly confirms the unreviewed install
3. the install command includes `--allow-unsafe`

## Prerequisites

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This instruction operationalizes the unsafe bypass by telling the agent to pass --allow-unsafe for unreviewed suggestions, making it easier to convert research results into real installations. In the context of a Linux installer skill, that is especially risky because users may treat the helper's output as vetted, while the underlying package metadata is explicitly described as unreviewed and untrusted.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

linux-installer install "roblox" --source flatpak --package org.vinegarhq.Sober --yes --allow-community

text

For an unreviewed suggestion, include `--allow-unsafe` and ensure opt-in support for unreviewed suggestions is enabled in `openclaw.json`.

7. Return the launch command:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The dangerous parameter here is --noconfirm, which forces pacman to proceed without interactive checks during a root-level package install. While there is no argument injection, this is still a real tool-usage risk because the skill is preauthorizing a high-impact flag that suppresses normal safety barriers.

Content

Scanner excerpt · catalog.json (reported line 209)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "audacity"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This pacman invocation includes a parameter that disables user confirmation, making privileged installation proceed automatically. In an installer skill, that is a meaningful abuse-prone tool configuration because it lowers the guardrails around root actions.

Content

Scanner excerpt · catalog.json (reported line 304)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "gimp"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The issue is not user-controlled injection but the catalog's built-in use of a tool parameter that suppresses pacman's safety prompts. Because this skill installs software locally, such suppression materially increases the chance of unsafe or unintended privileged changes.

Content

Scanner excerpt · catalog.json (reported line 411)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "alacritty"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

By embedding --noconfirm in the install recipe, the catalog configures pacman in an unsafe noninteractive mode. In context, this makes the helper more dangerous because it can carry out root-level package actions without the user's final approval in the package manager itself.

Content

Scanner excerpt · catalog.json (reported line 487)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "kitty"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This entry hardcodes a parameter that strips away pacman's interactive safeguard during installation. For a skill whose main purpose is local software installation, that is a substantive unsafe-tooling pattern with elevated potential impact on the host.

Content

Scanner excerpt · catalog.json (reported line 1812)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "terminator"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The pacman command is configured to bypass confirmation, which is a risky parameter choice for a privileged system-management tool. Even with fixed package names, this weakens execution safety by allowing automatic host modification.

Content

Scanner excerpt · catalog.json (reported line 2320)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "vlc"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This recipe uses pacman's confirmation-suppression flag, reducing the ability of the user to catch or stop unintended package actions. In an automated installer context, that makes privileged operations more abuse-prone and less transparent.

Content

Scanner excerpt · catalog.json (reported line 2445)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "blender"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Embedding --noconfirm in a root package install recipe is an unsafe parameterization of pacman that removes an important safety barrier. That is especially problematic in a skill intended to automate or assist installation tasks on the local system.

Content

Scanner excerpt · catalog.json (reported line 2540)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "inkscape"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The recipe configures pacman to skip confirmation during privileged installation, which increases the likelihood of silent or unintended host changes. In this skill's context, that is a real vulnerability pattern because the catalog directly influences execution behavior.

Content

Scanner excerpt · catalog.json (reported line 2635)May include surrounding context.

json
"sudo",
              "pacman",
              "-S",
              "--noconfirm",
              "krita"
            ]
          ],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The --noconfirm flag disables an important safety control in the AUR helper, allowing installation to proceed without interactive review. Because AUR content is community-maintained and this skill can resolve packages dynamically, suppressing that prompt materially increases the chance of unsafe software installation.

Content

Scanner excerpt · main.py (reported line 127)May include surrounding context.

python
helper = capabilities.get("aur_helper")
    package = candidate["package"]
    if helper:
        return [[helper, "-S", "--noconfirm", package]]
    return candidate.get("install", [])

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The --noconfirm parameter allows pacman to make privileged system changes without an interactive confirmation. Even for a fixed package like flatpak, this weakens human oversight in a high-impact operation initiated by an agent skill.

Content

Scanner excerpt · main.py (reported line 221)May include surrounding context.

python
]
        if native_manager == "pacman":
            return [
                ["sudo", "pacman", "-S", "--noconfirm", "flatpak"],
                [
                    "flatpak",
                    "remote-add",

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

This uses --noconfirm with an AUR helper to install snapd and then enables services, bypassing safeguards on a community-maintained install path. The parameter abuse is dangerous because it streamlines privileged, persistent host modification from partially untrusted metadata.

Content

Scanner excerpt · main.py (reported line 260)May include surrounding context.

python
if not helper:
                return []
            return [
                [helper, "-S", "--noconfirm", "snapd"],
                ["sudo", "systemctl", "enable", "--now", "snapd.socket"],
                ["sudo", "ln", "-sf", "/var/lib/snapd/snap", "/snap"],
            ]

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The --noconfirm flag removes pacman confirmation for installing wine/winetricks, enabling unattended capability expansion on the host. While the package names are fixed, the parameter reduces safety controls around a privileged system change.

Content

Scanner excerpt · main.py (reported line 280)May include surrounding context.

python
if native_manager == "dnf":
            return [["sudo", "dnf", "install", "-y", "wine", "winetricks"]]
        if native_manager == "pacman":
            return [["sudo", "pacman", "-S", "--noconfirm", "wine", "winetricks"]]
        if native_manager == "zypper":
            return [["sudo", "zypper", "install", "-y", "wine", "winetricks"]]

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The --noconfirm flag on pacman removal suppresses the interactive checkpoint for a destructive operation. In an agent environment this can accelerate accidental package removal and dependency cleanup without sufficient user verification.

Content

Scanner excerpt · main.py (reported line 312)May include surrounding context.

python
if source == "zypper":
        return [["sudo", "zypper", "remove", "-y", package]]
    if source == "pacman":
        return [["sudo", "pacman", "-Rns", "--noconfirm", package]]
    if source == "aur":
        helper = capabilities.get("aur_helper")
        if helper:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Using --noconfirm with an AUR helper for package removal bypasses safeguards on a community-oriented package-management path. This can enable unattended destructive actions with less oversight than native package-manager flows.

Content

Scanner excerpt · main.py (reported line 316)May include surrounding context.

python
if source == "aur":
        helper = capabilities.get("aur_helper")
        if helper:
            return [[helper, "-Rns", "--noconfirm", package]]
        return []
    if source == "nix":
        return [["nix", "profile", "remove", package]]

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The generated pacman command bakes in --noconfirm for dynamic package installs, reducing user control over privileged changes. In the context of an installer skill, this is more dangerous than a generic CLI because the whole purpose is host modification.

Content

Scanner excerpt · main.py (reported line 548)May include surrounding context.

python
{
                    "source": "pacman",
                    "package": package,
                    "install": [["sudo", "pacman", "-S", "--noconfirm", package]],
                    "launch": [package],
                    "reason": "Exact pacman package match.",
                        "warnings": [],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The generated AUR install command combines dynamic package discovery with --noconfirm, defeating the normal review barrier for a community-maintained repository. This is a strong true positive because it meaningfully lowers protections around one of the highest-risk installation sources supported by the skill.

Content

Scanner excerpt · main.py (reported line 657)May include surrounding context.

python
{
                        "source": "aur",
                        "package": package,
                        "install": [[helper, "-S", "--noconfirm", package]],
                        "launch": [package],
                        "reason": f"Exact AUR package match via {helper}.",
                        "warnings": [

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · main.py (reported line 1025)May include surrounding context.

python
print_json(
            {
                "status": "unsafe_confirmation_required",
                "message": "This candidate is unreviewed. Re-run with --allow-unsafe only after explicit unsafe-mode confirmation from the user.",
                "source": candidate["source"],
                "package": candidate["package"],
                "source_url": candidate["source_url"],

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · main.py (reported line 1225)May include surrounding context.

python
print_json(
            {
                "status": "unsafe_confirmation_required",
                "message": "This candidate is unreviewed. Re-run with --allow-unsafe only after explicit unsafe-mode confirmation from the user.",
                "source": candidate["source"],
                "package": candidate["package"],
                "source_url": candidate["source_url"],

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README includes install and uninstall examples using --yes, which suppresses interactive confirmation for operations that modify system state. In a skill specifically designed to install software, this makes unsafe automation more likely because users or downstream agents may copy the exact commands without noticing that they bypass confirmation and can change packages or remove software immediately.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to read local files and invoke shell commands, but it declares no tool scope or permissions boundary. That omission weakens enforcement and review because the runtime may grant broader capabilities than users expect for a package-installation workflow that can change the host system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The catalog includes privileged install commands using sudo without an adjacent warning or enforced confirmation. In an installer skill, that matters because the helper may present or execute system-modifying commands with elevated privileges without making the security boundary explicit to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.