Beddel

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 0.1.0

Overview

This appears to be a real workflow tool, but it can install packages/plugins and run local commands or delegated agents, so it needs careful review before installation.

Install only if you trust the Beddel package and @botanarede/beddel plugin source. Review workflows before running them, especially any workflow using shell_exec, agent-exec, $env variables, plugin installation, or beddel serve. Avoid running untrusted YAML, do not pass secrets into prompts or tool outputs, and prefer pinned package/plugin versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-31, SKILL.md:67-69, SKILL.md:150-157, README.md:6-9, and examples/setup-beddel.yaml:23-29
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:29-31:

bash

python3.11 -m pip install "beddel[all]"
beddel version

SKILL.md:67-69:

bash

openclaw plugins install @botanarede/beddel

examples/setup-beddel.yaml:23-29:

yaml

- id: install_plugin
  primitive: tool
  config:
    tool: shell_exec
    arguments:
      cmd: "openclaw plugins install @botanarede/beddel"
    timeout: 120

README.md:6-9:

bash

openclaw skills install --from ./skill
openclaw plugins install @botanarede/beddel

Technical Analysis

The installation instructions and bundled setup workflow retrieve packages without an exact version or integrity constraint. Consequently, the code installed and executed is determined by the package registries at installation time rather than by the reviewed skill contents.

The Python command also installs the broad all extra, expanding the transitive dependency set and supply-chain attack surface. The OpenClaw package may be downloaded and loaded automatically when the workflow's plugin-status check decides installation is required. Package-controlled installation hooks and runtime initialization may execute under the invoking user's account.

This finding does not establish that the named packages are malicious. The vulnerability is the absence of controls ensuring that future installations resolve to the exact versions and artifacts that were reviewed.

Attack Path

1. An attacker compromises a release account, package version, registry delivery path, or transitive dependency.
2. The attacker publishes malicious code under a version satisfying the unconstrained installation command.
3. A user follows the docu ...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the Python package and OpenClaw plugin to exact, reviewed versions.
• Use dependency lockfiles and cryptographic integrity hashes where supported.
• Pin and audit transitive Python dependencies instead of relying on the unconstrained all extra.
• Restrict package sources to approved registries and enable registry signature or provenance verification.
• Require explicit user confirmation before the bundled workflow installs or updates executable packages.
• Verify the package name, resolved version, publisher identity, and artifact integrity before loading the plugin.
• Separate installation from routine workflow execution so ordinary runs cannot silently introduce new executable dependencies.
• Periodically review pinned versions and update them through a controlled security review process.

T09 · Insecure Skill Coding Practices

Note

• Location: references/primitives.md:146

Finding

Untrusted Workflow Input Is Interpolated into a Process Command String

Content

View full analysis

Vulnerability Details

File Location: references/primitives.md:146-153
Vulnerability Type: Argument and option injection through unsafe command construction
Risk Level: Low

Vulnerable Code

yaml

- id: run
  primitive: tool
  config:
    tool: shell_exec
    arguments:
      cmd: "ls -la $input.directory"
      timeout: 30

Technical Analysis

The documented example embeds the externally supplied $input.directory value directly into a command string. The documentation states that shell_exec uses shell=False and shlex.split(). This prevents conventional shell metacharacters from being evaluated by a shell, but it does not make string-based command composition safe.

Tokenization occurs after variable interpolation. An attacker can therefore supply whitespace-separated operands or values beginning with a hyphen, causing the target program to interpret input as additional options. Quoting behavior may also allow one logical value to become multiple process arguments.

The demonstrated ls command has limited direct impact, but the example teaches a reusable pattern that becomes more severe with executables whose command-line options can write files, load configuration, disclose data, or launch subprocesses. shell=False should not be represented as complete protection against command injection because argument injection remains possible.

Attack Path

1. A workflow accepts an attacker-controlled directory input.
2. Variable resolution embeds that input into cmd: "ls -la $input.directory".
3. shlex.split() tokenizes the resulting string.
4. An input containing whitespace or option-prefixed values becomes additional command-line arguments.
5. The invoked executable processes the injected options or operands with the privileges of the workflow process.
6. If the same documented pattern is reused with a more capable executable, the attacker may trigger unintended file acc ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Replace command strings with a structured argument-array interface, keeping each untrusted value in a distinct argument.
• Insert the end-of-options marker -- before untrusted positional values when the target executable supports it.
• Validate directory values against an approved base directory and resolve canonical paths before execution.
• Reject option-prefixed values, unexpected whitespace, control characters, and paths outside the permitted root.
• Maintain a strict executable allowlist and define per-tool argument schemas.
• Update the documentation to explain that shell=False mitigates shell interpretation but does not prevent argument or option injection.
• Use a safe example such as an explicitly structured invocation equivalent to ["ls", "-la", "--", validated_directory].

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

- `variable-resolution.md` — Namespaces, custom resolvers, error handling

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This workflow's actual behavior is plugin installation and verification via OpenClaw, which is materially different from the skill's declared purpose of executing or validating YAML AI workflows. That mismatch is dangerous because it grants system-modifying capability under misleading packaging, increasing the risk that users or higher-level agents invoke it expecting harmless workflow handling while it performs local environment changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file uses shell_exec to run local commands that inspect, install, and verify an OpenClaw plugin, which introduces direct command-execution and package-installation capability unrelated to the advertised YAML workflow function. In this skill context, that makes the behavior more dangerous because consumers may grant trust appropriate for workflow orchestration, not for host modification and package installation through shell access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match common requests such as 'create a workflow' or 'execute pipeline,' which may cause the skill to activate outside narrowly intended Beddel-specific contexts. Because the skill can run workflows, invoke tools, install plugins, and potentially expose services, overbroad triggering increases the risk of accidental invocation of powerful capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation includes plugin installation and shell_exec-based command execution, which are broader and more powerful than the stated workflow-focused purpose. This creates a path for arbitrary system command execution and package installation under the guise of workflow handling, increasing the chance of privilege misuse, supply-chain exposure, or unintended host modification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest frames the skill as running, creating, validating, and debugging workflows, but the documentation also exposes beddel serve, which turns a workflow into an HTTP endpoint. That materially expands the attack surface from local workflow execution to network service exposure, and users or orchestrators may invoke the skill without realizing it can open a listening service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes a shell execution primitive, including a built-in shell_exec tool that runs arbitrary commands derived from workflow input. In a skill framed as YAML workflow orchestration, this materially expands capability into host command execution and can enable command abuse, sensitive file access, or destructive actions if workflows are user-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The shell execution documentation provides direct command-running examples without any warning about command injection, unsafe interpolation, or the risks of executing user-controlled input. This increases the likelihood that workflow authors will compose dangerous command strings such as ls -la $input.directory without sanitization or allowlisting.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The agent-exec primitive permits delegation to external agents with workspace-write and danger-full-access sandbox modes, which is a substantial privilege escalation beyond simple workflow/LLM orchestration. If exposed through user-authored workflows or weak policy controls, this could allow file modification, unsafe tool use, or broader system actions by an autonomous agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly supports resolving values from os.environ via $env, which can expose secrets such as API keys, tokens, or credentials to workflow steps and prompts. In an AI workflow system with multi-step LLM/tool execution, this increases the risk of inadvertent secret disclosure to logs, model providers, downstream tools, or generated outputs if users reference sensitive environment variables without safeguards.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The trust statement claims the system does not collect telemetry by default and that OpenTelemetry export is opt-in, while the manifest description says the skill provides OpenTelemetry tracing and the observability section states Beddel emits spans for every workflow and step execution. Even if export is optional, the documentation creates a contradictory impression about whether telemetry/tracing is active by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.