T09 · Insecure Skill Coding Practices
Error
- Location
lib/modelSelector.js:169- Finding
Arbitrary JavaScript Execution Through Unsafe Configuration Parsing
- Content
View full analysis
- Remediation
View remediation
Security audit
Multi-Agent Engine v8
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real multi-agent research orchestrator, but it needs Review because unsafe config parsing and path handling could let local files execute code or write outside the intended workspace.
Install only if you are comfortable reviewing and trusting the code. Before use, remove the eval fallback in lib/modelSelector.js, validate agent and workflow identifiers, and treat archive_and_clean as destructive for shared workspace files. Expect persistent local files under ~/.openclaw/workspace, including profiles, model settings, capability data, logs, archives, and reports.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/archiver.js:47- Finding
Archive Directory Traversal Through Unvalidated Workflow Identifier
- Content
View full analysis
{ const workflow = { id: params.workflow_id || `wf_${Date.now()}`, goal: params.goal || 'Not specified', template: params.template || 'deep_research', }; const result = archiveWorkflow(workflow); ``` The same behavior is present in the combined archive-and-clean command: ```js archive_and_clean: (params) => { const workflow = { id: params.workflow_id || `wf_${Date.now()}`, goal: params.goal || 'Not specified', template: params.template || 'deep_research', }; const result = archiveAndClean(workflow); ``` The archiver uses the identifier as a path component without validation: ```js export function archiveWorkflow(workflow, options = {}) { const wfId = workflow.id || `wf_${Date.now()}`; const archivePath = path.join(ARCHIVE_DIR, wfId); ``` It later writes archive metadata at the resulting location: ```js fs.writeFileSync( path.join(archivePath, 'index.json'), JSON.stringify(index, null, 2), 'utf-8' ); // Generate human-readable summary const summary = generateSummary(index); fs.writeFileSync(path.join(archivePath, 'summary.md'), summary, 'utf-8'); ``` ### Technical Analysis `params.workflow_id` is attacker-controlled input. It is assigned to `workflow.id` and passed to `path.join(ARCHIVE_DIR, wfId)` without character validation, canonicalization checks, or enforcement that the resolved path remains under `ARCHIVE_DIR`. On Node.js, traversal components such as `..` are normalized by path operations. A value containing sufficient traversal segments can therefore redirect `archivePath` outside `~/.openclaw/workspace/archive`. The function creates ...[truncated 1870 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:399- Finding
Agent Name Path Traversal in Workspace and Report Paths
- Content
View full analysis
{ if (!params.name) return "Missing --name parameter"; const config = loadJSON(PROFILES_FILE, { agents: [] }); if (config.agents.find(a => a.name === params.name)) { return `Agent "${params.name}" already exists`; } const agent = { name: params.name, description: params.description || "", capabilities: Array.isArray(params.capabilities) ? params.capabilities : (params.capabilities || "").split(",").map(s => s.trim()).filter(Boolean), output_format: params.output_format || "markdown", protocol: params.protocol || "HTTP", tools: Array.isArray(params.tools) ? params.tools : (params.tools || "").split(",").map(s => s.trim()).filter(Boolean), created_at: new Date().toISOString(), updated_at: new Date().toISOString() }; config.agents.push(agent); saveJSON(PROFILES_FILE, config); return `Created agent profile: ${agent.name}`; }, ``` Initialization uses the stored name as a path component: ```js for (const agent of agents) { const agentWorkspace = path.join(CONFIG_DIR, 'agents', agent.name); if (fs.existsSync(agentWorkspace)) { existed.push(agent.name); } else { fs.mkdirSync(agentWorkspace, { recursive: true }); created.push(agent.name); } } ``` Planning also constructs agent workspace paths from the persisted value: ```js if (profilesData.agents && Array.isArray(profilesData.agents)) { for (const agent of profilesData.agents) { profiles[agent.name] = { ...agent, workspace: path.join(CONFIG_DIR, 'agents', agent.name) }; } } ``` The executor uses the same value in an ...[truncated 3206 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (76)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Persistent storage of capability data, reasoning-support detection, response analysis, and override management are materially different from the orchestrator features claimed in the manifest. This makes the skill more dangerous because it can silently build and maintain local behavioral profiles or control matrices while presenting itself as a simple research/orchestration tool.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Built-in agent templates assign the
execcapability to technical and developer roles, expanding the skill from orchestration/research into arbitrary command execution. If downstream prompt construction or task inputs are user-controlled, spawned agents may be induced to run shell commands, enabling workspace tampering, secret exposure, or host-level actions beyond the skill's stated purpose.- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `背景: ${context.goal}\n\n`; } return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `背景: ${context.goal}\n\n`; } return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `背景: ${context.goal}\n\n`; } return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `背景: ${context.goal}\n\n`; } return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `背景: ${context.goal}\n\n`; } return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js instructions += `- （无法读取共享目录）\n`; } return instructions; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js instructions += `- （无法读取共享目录）\n`; } return instructions; } /**
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The docstring advertises 'active polling,' '1 hour timeout handling,' status logging per poll, and 'sessions_send message traceability.' However, the function never loops, never waits until timeout, never uses POLL_INTERVAL_MS or TIMEOUT_MS, and does not verify any message routing; it only validates existing report files once and returns.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js */ function inferTier(modelId, cost) { const rules = loadRules(); if (rules?.tiers?.[modelId]) return rules.tiers[modelId]; // 免费模型 if (modelId.includes(':free') || modelId === 'openrouter/free') return 'free';
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The selector falls back to
(0, eval)('(' + configRaw + ')')when JSON parsing fails, which executes attacker-controlled JavaScript from~/.openclaw/openclaw.json. A model selector only needs to parse configuration data, so introducing code execution here is unjustified and turns a malformed or tampered local config into arbitrary code execution in the Node.js process.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises command-driven behavior and the static analysis indicates environment-access capability, but the manifest declares no explicit tool scope or permissions. In an agent ecosystem, undeclared access increases the chance of over-privileged execution and prevents users or policy engines from understanding what the skill can inspect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a multi-agent orchestrator for research, decomposition, parallel execution, validation, and decisions. However, this file inspects process.env values like OPENCLAW_VERSION, USERPROFILE, and HOME and performs filesystem permission probing by creating and deleting directories before any user command runs, which are host-environment introspection capabilities beyond the core orchestration role.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The run guide explicitly sets the output language to "zh-CN", which imposes a specific locale on users. The file otherwise does not provide any opt-in, override, or justification for requiring Chinese output, so this is a natural-language locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JavaScript file contains natural-language comments, template names, section names, status strings, and formatted report output exclusively in Chinese, indicating the skill is designed to operate in a fixed language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The main entry point automatically calls cleanShared() immediately after archiving, which recursively deletes all files under the shared workspace without any confirmation, safety interlock, or scope restriction visible to the caller. In a multi-agent orchestrator, shared/ is a high-value working area; unexpected cleanup can destroy in-progress artifacts, erase forensic evidence, or remove files another concurrent workflow still depends on.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains user-facing natural-language descriptions, prompts, and instructions entirely in Chinese, including task prompts and feedback text. Because the skill does not offer users a language/locale option or justify a Chinese-only constraint, it may violate a language/locale policy requiring user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file-level documentation claims the system can automatically complete configuration after user consent, but the implementation only auto-creates directories and never creates the required JSON config files it flags as missing. This mismatch can mislead users and higher-level automation into believing the environment is fully prepared, causing failed execution or unsafe operator assumptions about what was configured.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- lib/modelSelector.js:184