Security audit

Repo Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent repo-onboarding purpose, but it asks agents to run unreviewed local scripts and optionally install a persistent daily cron task without enough user control or disclosure.

Review this carefully before installing. Only run the setup scripts if you trust the exact local files at the referenced paths, understand what repository files they will change, and explicitly want a cron job that keeps running later. Prefer a version that bundles reviewed package-relative scripts, shows proposed changes, and documents how to remove any scheduled task.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:45
Finding: Optional Installation of a Persistent Scheduled Task
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:22
Finding: Execution of Unverified Scripts Outside the Audited Skill Package
Content: View full analysis
docs/pm/architecture-assessment.json # 2) dependency analysis python /home/broedkrummen/.openclaw/workspace-cody/skills/senior-architect/scripts/dependency_analyzer.py . --output json > docs/pm/dependency-analysis.json # 3) architecture diagram (mermaid) python /home/broedkrummen/.openclaw/workspace-cody/skills/senior-architect/scripts/architecture_diagram_generator.py . --format mermaid -o docs/pm/architecture-diagram.md ``` ```bash bash /home/broedkrummen/.openclaw/workspace-cody/skills/repo-kanban-pm/scripts/init_repo_pm.sh "$(pwd)" ``` ```bash bash /home/broedkrummen/.openclaw/workspace-cody/skills/repo-kanban-pm/scripts/add_daily_pm_cron.sh "$(pwd)" --agent cody --tz UTC --time 09:30 ``` ### Technical Analysis The Skill delegates repository inspection, repository modification, and scheduled-task installation to Python and shell scripts located outside the audited package. These files were not present in the supplied project, so their contents and security properties could not be reviewed. The paths are absolute and user-specific but are not integrity-pinned. Replacing or modifying a referenced file changes the effective behavior of the Skill without requiring any update to `SKILL.md`. Invoking the files through Python or Bash grants them ordinary code-execution capabilities under the invoking user's identity. This creates a local trust-boundary weakness: legitimate-looking onboarding commands can execute substituted or compromised logic from mutable external locations. ### Attack Path 1. An attacker, compromised process, or untrusted installation obtains write access to one of the referenced exter ...[truncated 1398 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to execute local shell scripts that modify the repository and optionally install a cron job, but it does not clearly warn the user that these are system-impacting operations. This is dangerous because onboarding appears routine and low-risk, yet it can persist changes outside normal repo edits, including scheduled execution on the host, which expands the blast radius if the scripts are unsafe or tampered with.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.