Idea Storm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:35 PM UTC
• Version: 1.1.0

Overview

This skill is not clearly malicious, but it needs Review because it exposes live credentials to a permissive automated coding sandbox and persistent workspaces.

Install only if you are comfortable with an automated coding workflow that can run Docker, spawn background agents, write experiment files, send results to Notion, and place model credentials inside a container. Use a dedicated low-privilege model key and Notion integration, avoid sensitive source/data unless redacted, and prefer fixing the shell quoting, chmod 777, unpinned image/dependencies, and --dangerously-skip-permissions before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run-sandbox.sh:18

Finding

Shell Command Injection Exposes Model API Credentials

Content

View full analysis

/dev/null || true echo "🐳 Running Claude Code in sandbox..." echo " Experiment: $EXPERIMENT_ID" echo " Directory: $EXP_DIR" echo "" docker run --rm -t \ -e ANTHROPIC_AUTH_TOKEN="$API_KEY" \ -e ANTHROPIC_BASE_URL="$BASE_URL" \ -v "$EXP_DIR":/workspace \ idea-lab-sandbox \ bash -c "cd /workspace && git init -q 2>/dev/null; claude --print --dangerously-skip-permissions \"$PROMPT\"" ``` ### Technical Analysis The prompt is obtained from command-line arguments or a file and is then interpolated directly into a string passed to `bash -c`. Shell metacharacters and embedded quotation marks in `PROMPT` are therefore interpreted by the inner shell rather than being preserved exclusively as data for Claude Code. An attacker who can influence the prompt can terminate the quoted `claude --print` argument and append arbitrary shell commands. Those commands execute inside a container that: - Receives the model API credential through `ANTHROPIC_AUTH_TOKEN`. - Receives a configurable provider URL through `ANTHROPIC_BASE_URL`. - Has outbound network access unless separately restricted. - Has read/write ...[truncated 1457 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:326

Finding

Documented Workflow Exposes Credentials to Unrestricted Generated-Code Execution

Content

View full analysis

:/workspace \ idea-storm-sandbox \ bash -c 'cd /workspace && git init -q 2>/dev/null; claude --print --dangerously-skip-permissions ""' ``` The child-agent invocation template repeats the same design: ```text exec( command="API_KEY=$(python3 -c \"import json; print(json.load(open('/root/.openclaw/openclaw.json'))['models']['providers']['cc']['apiKey'])\") && BASE_URL=$(python3 -c \"import json; print(json.load(open('/root/.openclaw/openclaw.json'))['models']['providers']['cc']['baseUrl'])\") && docker run --rm -t -e ANTHROPIC_AUTH_TOKEN=$API_KEY -e ANTHROPIC_BASE_URL=$BASE_URL -v /root/.openclaw/workspace/experiments/:/workspace idea-storm-sandbox bash -c 'cd /workspace && git init -q 2>/dev/null; claude --print --dangerously-skip-permissions \"\"'", pty=true, timeout=300 ) ``` ### Technical Analysis The documented operational workflow reads a model API key from the host's OpenClaw configuration and injects it into a container that runs an autonomous coding tool with permission checks disabled. The same container receives a writable experiment volume and can execute generated code. Model authentication is related to the Skill's functionality, but exposing the credential to the entire generated-code execution environment exceeds minimum privilege. Any malicious prompt, compromised generated depe ...[truncated 1685 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/run-sandbox.sh:33

Finding

Experiment Workspace Is Made World-Writable

Content

View full analysis

/dev/null || true ``` ### Technical Analysis The script grants read, write, and execute permissions on the experiment directory to the owner, group, and every other local account. This exceeds the access required to make the directory writable by container UID 1000. Suppressing errors with `2>/dev/null || true` also prevents operators from learning when the intended permission setup fails. A world-writable experiment directory is especially sensitive because it contains prompts, source code, experiment state, input data, results, and reports that are consumed by autonomous agents. The permission change creates a local cross-user trust-boundary violation. Any local user or process able to reach the directory can replace or modify its contents without authorization. ### Attack Path 1. The sandbox launcher changes the experiment directory mode to `0777`. 2. Another local account or compromised process discovers the experiment directory. 3. That actor alters `PROMPT.md`, `experiment.yaml`, source code, tests, or validation output. 4. A later agent iteration reads the modified files as trusted experiment state or implementation input. 5. The modified prompt or code executes in a container that may receive model credentials and network access. 6. The attacker can consequently influence generated code, steal credentials through a secondary execution path, or falsify experiment results. ### Impact Assessment The issue permits unauthorized reading and modification of experiment data by other local users and processes. It undermines source integrity, validation reliability, and confidentiality. When combined with later credential-bearing sandbox execution, modified files can become an ...[truncated 82 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:295

Finding

Unpinned Executable Package and Mutable Base Image

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is especially severe because the skill's documented behavior includes reading host credentials from /root/.openclaw/openclaw.json, injecting them into containers, mounting experiment directories, and invoking claude --dangerously-skip-permissions. Those actions are far more sensitive than the benign-seeming 'idea validation' framing and materially increase the chance of unnoticed credential exposure or unsafe autonomous actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is especially severe because the skill's documented behavior includes reading host credentials from /root/.openclaw/openclaw.json, injecting them into containers, mounting experiment directories, and invoking claude --dangerously-skip-permissions. Those actions are far more sensitive than the benign-seeming 'idea validation' framing and materially increase the chance of unnoticed credential exposure or unsafe autonomous actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented use of Docker plus Claude Code with --dangerously-skip-permissions grants an autonomous tool broad authority to modify files and run commands with reduced safeguards. Even inside a container, the mounted workspace, network access, and injected credentials mean the operation can still damage project data, leak secrets, or execute unsafe actions at scale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs reading API credentials directly from a host-level secrets file under /root/.openclaw/openclaw.json and passing them into a container environment. That creates a clear secret-exfiltration and privilege-expansion path: any compromise of the spawned process or container can expose reusable credentials unrelated to the user's specific experiment.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using chmod 777 on a user-influenced experiment directory is an unsafe parameter choice that over-broadens write access on the host. That parameter abuse is particularly risky here because the directory is then used as the live workspace for autonomous model-driven execution, enabling tampering and integrity loss.

Content

Scanner excerpt · scripts/run-sandbox.sh (reported line 34)May include surrounding context.

sh

BASE_URL=$(python3 -c "import json; print(json.load(open('$OC_CONFIG'))['models']['providers']['cc']['baseUrl'])")

# Ensure experiment dir is writable by container user (uid 1000)
chmod 777 "$EXP_DIR" 2>/dev/null || true

echo "🐳 Running Claude Code in sandbox..."
echo "   Experiment: $EXPERIMENT_ID"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script launches a containerized Claude session with reduced safeguards via --dangerously-skip-permissions but does not clearly communicate this to the user. In an experimentation skill that automates research, design, and validation, untrusted prompts are expected, so removing guardrails materially increases the chance of destructive or policy-violating actions inside the mounted workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script invokes claude --dangerously-skip-permissions, explicitly disabling an important safety control and allowing the model to execute actions in the mounted workspace without normal approval gates. Given this skill's purpose is automated experimentation and iteration, prompts and generated code are likely adversarial or untrusted, making permission bypass especially dangerous.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly directs use of powerful execution capabilities such as exec, Docker, file writes, and spawned background agents, yet it declares no explicit tool scope or permission boundaries. This creates an authorization gap where a broadly-invoked skill can perform high-impact actions without transparent restriction or least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Broad trigger phrases such as '实验一下', '帮我验证', and '迭代优化' are common conversational language and can activate a powerful execution-oriented skill unintentionally. Because this skill can spawn agents, write files, run code, and use external services, accidental invocation meaningfully raises the chance of unauthorized or surprising actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that experiment data will be written to local files and Notion, but it does not prominently warn users that their inputs, artifacts, and possibly code or datasets may be persisted and transmitted to a third-party service. In a research/engineering workflow, this can expose proprietary source code, internal problem statements, credentials embedded in files, or sensitive datasets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The Docker invocation uses the floating image name idea-storm-sandbox without a tag or digest, so future executions may run a different image than expected. That weakens reproducibility and allows accidental or malicious image substitution if the local tag is changed or rebuilt with unsafe contents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

This second Docker execution path also relies on an unpinned image reference, carrying the same risk of drift or substitution. Because the container receives credentials and a mounted workspace, image integrity matters more than in a low-privilege batch task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file instructs users to obtain and store a live Notion Internal Integration Token, but it does not include basic credential-handling guidance such as least-privilege scoping, secure storage, rotation, or warnings about exposing the token in shells, logs, or shared config files. In a skill that automatically writes experiment results to Notion, this increases the chance of accidental credential leakage or misuse of a token that grants write access to organizational content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This command sends authenticated data to an external third-party service using a bearer token, which is expected for Notion integration but still constitutes external transmission of potentially sensitive experiment metadata and content. Because the skill's purpose is to automatically research, validate, iterate, and store results, users may unknowingly export internal engineering ideas or data to Notion without sufficient awareness or review.

Content

Scanner excerpt · references/notion-setup.md (reported line 30)May include surrounding context.

创建页面：

bash

curl -X POST 'https://api.notion.com/v1/pages' \
  -H 'Authorization: Bearer $NOTION_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2022-06-28' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This command sends authenticated data to an external third-party service using a bearer token, which is expected for Notion integration but still constitutes external transmission of potentially sensitive experiment metadata and content. Because the skill's purpose is to automatically research, validate, iterate, and store results, users may unknowingly export internal engineering ideas or data to Notion without sufficient awareness or review.

Content

Scanner excerpt · references/notion-setup.md (reported line 30)May include surrounding context.

创建页面：

bash

curl -X POST 'https://api.notion.com/v1/pages' \
  -H 'Authorization: Bearer $NOTION_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2022-06-28' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notion-setup.md (reported line 48)May include surrounding context.

追加内容块：

bash

curl -X PATCH 'https://api.notion.com/v1/blocks/$PAGE_ID/children' \
  -H 'Authorization: Bearer $NOTION_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2022-06-28' \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads platform configuration to extract an API key and base URL, then later passes those secrets into the containerized runtime. This gives the skill access to credentials beyond what is disclosed in the manifest and expands the blast radius if the container, image, prompt, or model output is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently reads an API key from configuration and exposes it to the container as an environment variable, without any explicit warning or consent boundary. Because the container also runs model-directed commands, any prompt injection, compromised image, or malicious tooling inside the container could exfiltrate or misuse the credential.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Changing the experiment directory to mode 777 makes it world-writable, allowing any local user or process on the host to alter experiment contents. In this workflow, those contents are then mounted into a container running autonomous model-driven actions, so tampering can lead to poisoned inputs, overwritten results, or persistence of malicious files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script modifies filesystem permissions to world-writable without clearly warning the user that host-side access controls are being weakened. This can surprise operators and create an avoidable opportunity for local tampering or accidental modification of experiment inputs and outputs.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/run-sandbox.sh (reported line 34)May include surrounding context.

sh

BASE_URL=$(python3 -c "import json; print(json.load(open('$OC_CONFIG'))['models']['providers']['cc']['baseUrl'])")

# Ensure experiment dir is writable by container user (uid 1000)
chmod 777 "$EXP_DIR" 2>/dev/null || true

echo "🐳 Running Claude Code in sandbox..."
echo "   Experiment: $EXPERIMENT_ID"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The container is launched from an unpinned image name (idea-lab-sandbox) without an explicit tag or digest, so the code executed depends on whatever image is locally present or later pulled under that name. In a workflow that also injects API credentials and grants the model broad execution ability, image drift or substitution materially increases supply-chain risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The visible user-facing description and operational instructions are entirely in Chinese, and there is no statement that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, a forced locale without opt-in can be a policy issue.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.

md

FROM node:22-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 python3-pip python3-venv git curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
RUN npm install -g @anthropic-ai/claude-code
RUN useradd -m -s /bin/bash coder
RUN mkdir -p /home/coder/.openclaw /workspace && chown -R coder:coder /workspace /home/coder

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.

md

FROM node:22-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 python3-pip python3-venv git curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
RUN npm install -g @anthropic-ai/claude-code
RUN useradd -m -s /bin/bash coder
RUN mkdir -p /home/coder/.openclaw /workspace && chown -R coder:coder /workspace /home/coder

Static analysis

No suspicious patterns detected.