Rm Safety

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:03 AM UTC
• Version: 1.2.2

Overview

This skill is a disclosed safety guard for destructive file deletion commands, with no evidence of hidden execution, exfiltration, or persistence beyond normal skill installation.

Installing this skill is reasonable if you want extra confirmation before destructive delete commands. Prefer a pinned ClawHub CLI version or reviewed release/commit instead of mutable latest/default-branch install instructions, and still review any deletion confirmation carefully before approving it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Unpinned executable package installation through a mutable registry tag

Content

View full analysis

Vulnerability Details

File Location: README.md, line 37
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

bash

npx clawhub@latest install rm-safety

Technical Analysis

The recommended installation command uses npx with the mutable latest tag. This causes package content selected by the registry at installation time to be downloaded and executed. The effective installer can therefore differ from the version reviewed during this audit.

The command provides no exact version constraint, package integrity value, signature verification, or other mechanism that binds installation to an audited artifact. If the package publisher account, registry entry, or a future package release is compromised, malicious package code or lifecycle behavior could run during installation.

This is a supply-chain weakness in the documented installation process. No malicious package content or malicious intent was identified in the audited project itself.

Attack Path

1. An attacker compromises the clawhub package publisher account or otherwise gains control over a release selected by the latest tag.
2. The attacker publishes a modified package containing malicious installer or runtime behavior.
3. The registry points the mutable latest tag to that release.
4. A user follows the recommended npx clawhub@latest install rm-safety instruction.
5. npx retrieves and executes the attacker-controlled package.
6. The payload operates with the permissions of the user running the command.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on those privileges and the host environment, the malicious package could read or modify user-accessible files, access environment variables and credentials, alter installed skills, or install additional dependencies.

The direct scope is limited to permissions available to the invoking user unless the ...[truncated 122 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Publish and verify a cryptographic checksum or signed provenance statement for the expected package artifact.
• Use a lockfile or equivalent integrity-pinning mechanism where supported.
• Document the expected package publisher, registry, version, and integrity value.
• Require a new security review before updating the pinned version.
• Consider instructing users to download and inspect a versioned package before executing it rather than relying on automatic execution through a mutable tag.

T08 · Insecure Dependencies

Warning

• Location: README.md:44

Finding

Manual installation retrieves an unpinned mutable repository branch

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 44-47
Vulnerability Type: Unpinned source dependency
Risk Level: Medium

bash

git clone https://github.com/CaesarYP/rm-safety.git
cp -r rm-safety ~/.openclaw/workspace/skills/

Technical Analysis

The manual installation procedure clones the repository's current default branch and copies its contents directly into the active skills directory. It does not check out a reviewed commit or immutable release, nor does it verify a checksum or signature.

Because a default branch is mutable, the installed files may differ from the artifact covered by this audit. A repository compromise, malicious maintainer update, or unauthorized branch modification could place attacker-controlled instructions or files into the installed skill.

Cloning alone does not establish arbitrary code execution. The security consequence arises when the unchecked content is copied into the skills directory and subsequently loaded or used by the agent platform.

Attack Path

1. An attacker compromises the upstream repository or obtains permission to modify its default branch.
2. The attacker changes the skill instructions or adds harmful content.
3. A user follows the documented manual installation procedure without selecting a reviewed revision.
4. Git retrieves the modified default branch.
5. The user copies the unchecked repository into ~/.openclaw/workspace/skills/.
6. The agent platform subsequently loads or invokes the attacker-controlled skill content.

Impact Assessment

The attacker could replace the intended safety behavior with malicious or misleading skill instructions and gain access to whatever agent tools and permissions are available when that skill is loaded. Potential effects could include unauthorized agent actions or modification of user-accessible data.

The precise impact depends on the consuming platform's trust model and tool permissions. This finding does not establish that the cu ...[truncated 144 chars]

Remediation

View remediation

Remediation Suggestions

• Instruct users to check out an immutable, reviewed commit hash or a signed release tag before installation.
• Publish a checksum for the complete release archive and require verification before copying files.
• Prefer signed release artifacts over cloning the mutable default branch.
• Include explicit verification commands in the installation documentation.
• Protect release tags and the default branch with mandatory review, signed commits, and restricted write access.
• Perform a new audit whenever the pinned commit or release is updated.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (33)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

Example 2 | 示例 2: Directory Delete

bash

rm -rf ./build

Output | 输出:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 175)May include surrounding context.

md

rm -rf ./folder
rm -r /path/to/something
unlink file
shred secret.txt

# Should NOT trigger | 不应触发
trash file.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 140)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 140)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

**Still must ask even if user says not to | 仍需询问即使用户说不用问:**
- Deleting entire workspace directory | 删除整个 workspace 目录
- Deleting user home directory (`/Users/caesar/`) | 删除用户主目录
- Dangerous commands like `rm -rf /` (should refuse directly) | 使用 `rm -rf /` 等危险命令（应直接拒绝）
- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

- Path contains unescaped special characters (spaces, `;`, `|`, `&`) | 路径包含未转义的特殊字符

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Must refuse directly | 直接拒绝:**
- `rm -rf /` or `rm -rf /*` (system destruction) | 系统级危险命令
- `rm -rf ~` or `rm -rf /home/*` (user data destruction) | 用户数据毁灭
- Path resolves to root or system directories | 路径解析为根目录或系统目录

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

md

# Should trigger confirmation | 应该触发询问
rm file.txt
rm -rf ./folder
rm -r /path/to/something

# Should NOT trigger | 不应触发
trash file.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

# Should trigger confirmation | 应该触发询问
rm file.txt
rm -rf ./folder
rm -r /path/to/something

# Should NOT trigger | 不应触发
trash file.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

md

# Should trigger confirmation | 应该触发询问
rm file.txt
rm -rf ./folder
rm -r /path/to/something

# Should NOT trigger | 不应触发
trash file.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

# Should trigger confirmation | 应该触发询问
rm file.txt
rm -rf ./folder
rm -r /path/to/something

# Should NOT trigger | 不应触发
trash file.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

md

"updated": "2026-03-24 (v1.2.2)",
  "examples": [
    "rm file.txt → Triggers safety confirmation | 触发安全确认",
    "rm -rf ./folder → Shows file/dir count before execution | 显示文件/目录数",
    "trash file.txt → No confirmation needed (safe delete) | 无需确认（安全删除）"
  ],
  "features": [

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

"updated": "2026-03-24 (v1.2.2)",
  "examples": [
    "rm file.txt → Triggers safety confirmation | 触发安全确认",
    "rm -rf ./folder → Shows file/dir count before execution | 显示文件/目录数",
    "trash file.txt → No confirmation needed (safe delete) | 无需确认（安全删除）"
  ],
  "features": [

Static analysis

No suspicious patterns detected.