Skill Router BZai

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This skill can recommend and install other skills, but its advertised security review is mostly placeholder logic that can mark unverified packages as safe.

Review this carefully before installing. It is not clearly malicious, but do not rely on its security scores as an audit of other skills. Only approve installation of a recommended skill after independently checking the exact package, publisher, permissions, and what will be executed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/evaluate_skill.py:58

Finding

Placeholder Security Validation Can Approve and Lead to Execution of Unsafe Third-Party Skills

Content

View full analysis

list: """Perform basic security checks on a skill.""" issues = [] # Download and inspect skill code stdout, _, rc = run_cmd(["clawhub", "download", "--dry-run", skill_id]) if rc != 0: return ["Failed to download for security check"] # Check for suspicious patterns (placeholder) # Real implementation would: # - Scan for network calls # - Check file system access patterns # - Look for credential access # - Verify author reputation return issues ``` The resulting recommendation is connected to the following installation and execution instructions in `SKILL.md:65-71`: ```markdown ### 6. Execute After confirmation: - If skill not installed: `clawhub install ` - Execute the skill with original user request - Record actual metrics vs estimates ``` ### Technical Analysis `check_security()` does not inspect source code, manifests, permissions, dependencies, network endpoints, binaries, or author reputation. It only invokes `clawhub download --dry-run`. If that command succeeds, the function returns an empty issue list. The empty list is interpreted as a successful audit and gives the candidate a security score of `100` while repo ...[truncated 2994 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A router skill that claims to assess security, cost, speed, and quality but does not actually perform those checks undermines the trust boundary of the entire skill-selection process. Because it can query external catalogs and influence later installs/execution, missing the promised ranking and confirmation steps can lead users to act on unsupported recommendations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A router skill that claims to assess security, cost, speed, and quality but does not actually perform those checks undermines the trust boundary of the entire skill-selection process. Because it can query external catalogs and influence later installs/execution, missing the promised ranking and confirmation steps can lead users to act on unsupported recommendations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A router skill that claims to assess security, cost, speed, and quality but does not actually perform those checks undermines the trust boundary of the entire skill-selection process. Because it can query external catalogs and influence later installs/execution, missing the promised ranking and confirmation steps can lead users to act on unsupported recommendations.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/security-checklist.md (reported line 50)May include surrounding context.

md

Any of these disqualifies a skill:

- Obfuscated or minified code without source
- Requests to disable security features
- Attempts to access credentials or tokens
- Network calls to undocumented endpoints
- File system access outside workspace

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-checklist.md (reported line 51)May include surrounding context.

md

- Obfuscated or minified code without source
- Requests to disable security features
- Attempts to access credentials or tokens
- Network calls to undocumented endpoints
- File system access outside workspace
- Execution of downloaded code

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises shell and file-related operational behavior but does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: reviewers and users cannot reliably tell what capabilities the skill expects, and a runtime may permit broader access than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file mixes English headings with Chinese-only descriptive text such as '增收降本版' and '智能技能选择器' without stating that language choice is optional or user-selected. This creates a natural-language policy concern because the skill appears to assume a specific language/locale rather than offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation criteria are broad enough that the router may trigger on many normal requests where no routing is needed. Over-broad invocation increases the chance of unnecessary shell/catalog operations, accidental skill installation paths, or routing sensitive tasks through an extra component that expands the attack surface.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/evaluate_skill.py (reported line 16)May include surrounding context.

python

def run_cmd(cmd: list) -> tuple:
    """Run a command and return (stdout, stderr, returncode)."""
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout, result.stderr, result.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search_clawhub.py (reported line 16)May include surrounding context.

python

def run_cmd(cmd: list) -> tuple:
    """Run a command and return (stdout, stderr, returncode)."""
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout, result.stderr, result.returncode

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The docstring says 'Usage: calculate_cost.py <skill_name> [--task "description"]', implying an estimation-only interface, but main() also supports '--record', '--tokens', and '--time' to persist actual usage data. This is a documentation-to-code divergence because the documented usage actively understates the script’s second operational mode.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The module docstring and CLI usage at L002-L005 describe this script as estimating token and time costs, but the code also creates directories and writes historical execution data to ~/.openclaw/workspace/skill-router-history.json. Persistent state for future runs is not mentioned in the file documentation, so the implemented behavior exceeds the stated estimator-only description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script silently executes external commands such as openclaw, clawhub info, and clawhub download as part of evaluation, which can trigger network access or other side effects without explicit user disclosure at runtime. In a skill-selection/security-scoring context, this is more concerning because users may assume evaluation is passive, while it actually interacts with external tooling and potentially remote services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.