Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md SKILL_DIR="$(dirname "$(find /root/.openclaw -name 'SKILL.md' -path '*/vt-hash-intel/*' 2>/dev/null | head -1)")"
Security audit
VirusTotal Hash Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent VirusTotal lookup helper, but users should treat submitted indicators as data sent to a third-party service.
Install only if you are comfortable sending the indicators you provide to VirusTotal using your VT_API_KEY. Avoid submitting internal-only, customer-sensitive, embargoed, or investigation-sensitive IOCs unless your organization allows that workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Error | Cause | Response | |---|---|---| | `NotFoundError` | IOC not in VT DB | "Not found in VT. This does NOT mean it's safe." | | `AuthenticationError` | Bad/missing API key | "Check VT_API_KEY in your .env file." | | `QuotaExceededError` | Rate limit hit | "Rate limited. Wait and retry." | | `UnrecognizedIOC` | Cannot detect type | "Cannot identify this IOC type. Try --type flag." | | `ConnectionError` | Network issue | "Cannot reach VT API. Check network." |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill performs external network access, reads local files to locate its installation path, and uses an environment-provided API key, but it does not declare an explicit tool scope or permissions boundary. That increases the risk of overbroad execution and makes it harder for the platform to constrain or audit what the skill is allowed to do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description encourages users to paste hashes, URLs, domains, and IPs for enrichment but does not disclose that those artifacts will be transmitted to VirusTotal. In security operations, IOCs may be sensitive or embargoed, so silent third-party submission can expose investigations, customer data, or proprietary detections.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes very broad terms like 'IOC', 'threat intel', 'malware check', and 'VirusTotal/VT', which can cause the skill to activate during general security conversations rather than only on explicit lookup requests. Because this skill sends user-supplied indicators to an external service, accidental invocation can lead to unintended data disclosure and unnecessary API usage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly encourages users to submit hashes, URLs, domains, and IPs to VirusTotal but does not warn that these indicators may be sensitive and will be disclosed to a third-party service. In incident response and enterprise environments, even seemingly harmless IOCs can reveal ongoing investigations, internal infrastructure, customer data, or unreleased malware samples, creating confidentiality and operational risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The trigger list explicitly includes Chinese phrases alongside English ones, but the skill does not document whether multilingual activation is optional or user-configurable. This can create a locale-policy issue if the organization expects language selection to be explicit rather than hard-coded into the skill behavior.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The field named "http_response_code" is populated from "last_http_response_content_length", which is a different attribute entirely. This causes the skill to return misleading report data rather than the claimed enrichment details, creating a mismatch between described and actual behavior.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description explicitly advertises WHOIS info as part of the threat report. In both domain and IP parsers, the code reads a WHOIS-related attribute from the VirusTotal response, but neither parser includes that data in the final result object returned to the user, so the actual behavior falls short of the manifest's stated output.
- Content
Static analysis
No suspicious patterns detected.