T09 · Insecure Skill Coding Practices
Error
- Location
strategies/Main.md:227- Finding
Unsandboxed Execution of User-Submitted Code
- Content
View full analysis
- Remediation
View remediation
Security audit
botlearn-examiner
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent OpenClaw exam skill, but it needs Review because it directs running submitted code and retaining identifiable exam history without enough safety and retention boundaries.
Install only if you are comfortable with an examiner skill that may execute submitted code for scoring and keep detailed exam records. Before use, require sandboxed code execution, explicit consent for persistent history, clear retention/deletion controls, and more specific activation phrases.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
strategies/Main.md:405- Finding
Unspecified Retention of Identifiable Examination Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes very generic English words such as "exam," "test," "evaluation," and "assessment," which are likely to appear in ordinary user conversations unrelated to this skill. This can cause accidental activation, unintended context switching, or skill hijacking from more appropriate handlers, especially in shared or multilingual environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example workflow appears to require English control phrases and output (for example, typing "START" and following English exam instructions) without offering a user language choice. This is not a classic security flaw, but it can create unsafe or unreliable interaction patterns where users misunderstand prompts, submit malformed responses, or are socially steered into actions they did not intend.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 96% confidence
- Finding
Using "test" as a trigger conflicts with common built-in commands and ordinary user language. This shadowing can hijack intended commands or conversations, causing the wrong skill to activate and reducing reliability and safety of command routing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes very broad phrases such as "exam", "test", "evaluation", and short multilingual variants, which can cause the skill to activate during ordinary conversation rather than an explicit request for this specific skill. That creates prompt-routing ambiguity and increases the chance the agent enters an examination workflow unexpectedly, disrupting user intent and potentially suppressing safer or more appropriate handlers.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The trigger "run exam" overlaps with the generic action verb "run", which may conflict with built-in execution semantics or user instructions unrelated to this skill. In systems with command dispatch, this can produce routing confusion or unexpected invocation of the examination flow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 3. **Fair**: Difficulty must be appropriate for the declared level 4. **Transparent**: Scoring criteria must be clear and accessible 5. **Constructive**: Reports must provide actionable feedback, not just scores 6. **Privacy**: Exam results should not be shared without consent 7. **Reproducible**: Same conditions should yield similar results # Examination Dimensions
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation logic says "WHEN user triggers examination" and then proceeds directly into selecting scope, loading question banks, and beginning a session, but it does not define a strict, user-confirmed activation boundary. In a multi-skill environment, ambiguous activation conditions can cause accidental invocation or unintended state changes, especially when paired with the broad trigger set above.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The strategy describes collecting and storing detailed session contents, answers, scores, report data, timestamps, and user identifiers, but the earlier user-facing introduction does not clearly disclose this scope of collection. Lack of upfront transparency prevents informed consent and makes the data handling more dangerous in a skill centered on evaluating user capability.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The strategy explicitly updates user exam history, tracks progress over time, calculates improvement trends, and identifies behavioral patterns beyond the immediate exam session. This creates persistent profiling of user performance without clear necessity, retention limits, or explicit informed consent, increasing privacy risk if the data is misused, breached, or later repurposed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill asks users to contribute anonymized results to global benchmarks, which is a secondary data-sharing purpose beyond administering the exam. Even with anonymization claims, performance/configuration data can sometimes be re-identified or combined with other metadata, so this expands data exposure and privacy risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 88% confidence
- Finding
The trigger "考试" is very short and semantically broad, so it may match many unrelated Chinese-language requests involving exams in general. While not inherently dangerous, it increases accidental activation risk and may interfere with normal multilingual conversations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file includes several dimension headings with Chinese parenthetical labels such as "信息检索" and "内容理解" while the rest of the document is in English. Because the file does not explain that it is intended to be bilingual or offer a user language/locale choice, it may violate the language/locale policy against forcing a specific language without opt-in.
- Content