ClawHub
Back to skill

Security audit

CLI-Anything for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent methodology guide for building OpenClaw CLI harnesses, with expected but notable local file, clone, install, and subprocess side effects.

Install this if you want Codex/OpenClaw help building or validating CLI-Anything harnesses. Use it on repositories and paths you intend the agent to inspect or modify, and expect generated workflows to clone repos, create files under an agent-harness directory, run tests, install editable Python packages, and invoke real GUI/backend software when validating exports.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation description is broad enough to match common repository-analysis or local-path requests, which can cause the skill to be invoked outside its narrowly intended scope. Overbroad triggering increases the chance that methodology-specific instructions influence unrelated tasks, leading to inappropriate repository acquisition, unnecessary command planning, or unintended handling of local/GitHub inputs.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly directs the agent to clone a GitHub repository to a local working directory and then operate on the local copy, but it does not require user consent or warn about network access and filesystem writes. In an agent setting, this can cause unexpected external network interaction and persistent local changes, which is risky when the repository source is user-controlled or untrusted.

Missing User Warnings

Low
Confidence
81% confidence
Finding
This markdown file applies to SQP-2 and contains operational rules requiring CLIs to create projects, export/render files, and invoke real software via subprocesses. Although these behaviors are central to the harness purpose, the document does not explicitly warn users that commands may create or overwrite files or invoke external software on their system.

Static analysis

No suspicious patterns detected.