AI Agent Skill Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.2

Overview

The scanner mostly does what it claims, but it also ships an undisclosed Python module that can load and run code from an external workspace path if imported.

Review this before installing. The main vetter.py scanner is local and user-directed, but the package should remove or clearly justify brain_enhance.py, avoid loading code from /data/.openclaw/workspace/company-brain, and document exact filesystem scope. Do not rely on it as a complete security review, especially for secrets in skipped paths such as .env.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: brain_enhance.py:10

Finding

Untrusted Python Module Loading from a Shared Absolute Path

Content

View full analysis

Vulnerability Details

File Location: brain_enhance.py:10-16
Vulnerability Type: Unsafe Python import-path manipulation and out-of-package code execution
Risk Level: High

python

brain_path = Path("/data/.openclaw/workspace/company-brain")
if str(brain_path) not in sys.path:
    sys.path.insert(0, str(brain_path))

try:
    from brain_wrapper import Brain
    _brain = Brain()
except Exception:
    _brain = None

Technical Analysis

The module prepends /data/.openclaw/workspace/company-brain to sys.path and then imports brain_wrapper from that externally managed location. Python executes module-level code during import, so importing brain_enhance.py can execute arbitrary code supplied through brain_wrapper.py.

The imported implementation is outside the reviewed Skill package and can change independently of it. If the directory or module is writable by another user, process, workspace component, or compromised service, the import creates a code-execution boundary that is not protected by package pinning, integrity verification, or provenance validation.

Instantiating Brain() immediately at module scope increases exposure because execution occurs merely by importing brain_enhance.py; no explicit feature invocation is required. The broad except Exception also suppresses failures, reducing visibility into unexpected or malicious module-loading behavior.

This integration is not required for the declared local, line-based scanning functionality and is not used by scripts/vetter.py, so it exceeds the minimum behavior necessary for the scanner.

Attack Path

1. An attacker obtains write access to /data/.openclaw/workspace/company-brain, or compromises a process that can modify files in that directory.
2. The attacker creates or replaces /data/.openclaw/workspace/company-brain/brain_wrapper.py.
3. The malicious module places its payload in module-level ...[truncated 1459 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove brain_enhance.py and the external Brain integration if it is not required by the scanner. The main scanner currently operates without it.
2. Do not prepend shared or workspace directories to sys.path.
3. If the integration is required, distribute brain_wrapper as a normal, reviewed dependency from a trusted source and pin it to an exact version and integrity hash.
4. Keep dependencies inside a controlled virtual environment or package namespace whose files are not writable by untrusted users or unrelated workspace components.
5. Verify dependency provenance and integrity before loading it, using a trusted manifest or cryptographic signature.
6. Avoid module-scope initialization. Load and instantiate the optional component only after an explicit, authorized request.
7. Restrict ownership and permissions on any directory from which executable Python modules are loaded.
8. Replace the blanket exception handler with narrowly scoped exception handling and security-relevant logging so unexpected import behavior is visible.
9. If external policy text continues to be consumed, treat it as untrusted data, validate its structure and length, and prevent it from being interpreted as authoritative Agent instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a security scanner that detects various malicious or unsafe patterns in skills. This code chunk does not implement scanning or detection logic for secrets, unsafe execution, prompt injection, or malware. Instead, it dynamically adds a filesystem path, imports an external Brain wrapper, queries it for security policy guidance, and injects that guidance into a vetting prompt. That is a materially different purpose and includes undeclared access to an external workspace resource. While this could support a broader vetting system, this specific code's behavior is not accurately represented by the declared description.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

| Issue | Severity | Example |
|-------|----------|---------|
| `eval()` / `exec()` | Critical | Runs arbitrary code |
| Pipe to shell | Critical | `curl ... | bash` |
| Destructive commands | Critical | `rm -rf /`, `mkfs.` |
| `os.system()` | Critical | Shell commands |
| Hardcoded API keys | High | `api_key`, `apikey` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

|-------|----------|---------|
| `eval()` / `exec()` | Critical | Runs arbitrary code |
| Pipe to shell | Critical | `curl ... | bash` |
| Destructive commands | Critical | `rm -rf /`, `mkfs.` |
| `os.system()` | Critical | Shell commands |
| Hardcoded API keys | High | `api_key`, `apikey` |
| `shell=True` | High | Shell injection risk |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

|-------|----------|---------|
| `eval()` / `exec()` | Critical | Runs arbitrary code |
| Pipe to shell | Critical | `curl ... | bash` |
| Destructive commands | Critical | `rm -rf /`, `mkfs.` |
| `os.system()` | Critical | Shell commands |
| Hardcoded API keys | High | `api_key`, `apikey` |
| `shell=True` | High | Shell injection risk |

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

| `shell=True` | High | Shell injection risk |
| Hardcoded secrets | High | `auth_token`, `secret` |
| Credential file access | High | `.ssh/`, `.aws/` |
| Sudo elevation | High | `sudo` commands |
| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | `.git/config` reads |
| Password hardcoding | High | `password` literal |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | `.git/config` reads |
| Password hardcoding | High | `password` literal |
| Permission overrides | Medium | `chmod 777` |
| Network calls | Medium | `requests.post()` |

## New in v2.1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The scanner explicitly skips directories named .env, which can prevent inspection of files containing credentials, API keys, or other secrets stored in that location. In a security scanner context this is especially dangerous because it creates a blind spot an attacker or careless author could exploit to hide sensitive material from detection.

Content

Scanner excerpt · scripts/vetter.py (reported line 19)May include surrounding context.

python

from typing import Dict, List

# Directories and file types to skip (reduces false positives)
SKIP_DIRS = {"node_modules", "__pycache__", ".git", ".venv", ".env", "venv", "dist", "build", ".next"}
SKIP_EXT = {".png", ".jpg", ".jpeg", ".gif", ".ico", ".svg", ".woff", ".woff2", ".ttf", ".eot",
            ".pyc", ".pyo", ".so", ".o", ".a", ".class", ".jar",
            ".mp3", ".mp4", ".avi", ".mov", ".wav",

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/vetter.py (reported line 103)May include surrounding context.

python

line_lower = line.lower().strip()

        for sig in signatures:
            # Special handling for pipe-to-shell: only flag if curl/wget X | sh/bash pattern
            if sig["id"] == "pipe-to-shell":
                if "curl" in line or "wget" in line:
                    stripped = line.strip()

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · signatures.json (reported line 2)May include surrounding context.

json

{
  "_description": "Detection signatures for AI Agent Skill Scanner. These patterns search for TEXT FRAGMENTS that are commonly associated with security risks in AI agent skills.",
  "_note": "This file is read by the scanner (not executed). It is a signature database, similar to YARA or Snort rules.",
  "signatures": [
    {
      "id": "hardcoded-api-key",
      "category": "secrets",
      "severity": "high",
      "fragments": ["api_key", "api-key", "apikey", "API_KEY", "APIKEY"],
      "message": "Possible hardcoded API key"
    },
    {
      "id": "hardcoded-secret",
      "category": "secrets",
      "severity": "high",
      "fr

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 72)May include surrounding context.

json

"id": "destructive-command",
      "category": "destructive",
      "severity": "critical",
      "fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],
      "message": "Potentially destructive filesystem command"
    },
    {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 72)May include surrounding context.

json

"id": "destructive-command",
      "category": "destructive",
      "severity": "critical",
      "fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],
      "message": "Potentially destructive filesystem command"
    },
    {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 72)May include surrounding context.

json

"id": "destructive-command",
      "category": "destructive",
      "severity": "critical",
      "fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],
      "message": "Potentially destructive filesystem command"
    },
    {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 72)May include surrounding context.

json

"id": "destructive-command",
      "category": "destructive",
      "severity": "critical",
      "fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],
      "message": "Potentially destructive filesystem command"
    },
    {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 72)May include surrounding context.

json

"id": "destructive-command",
      "category": "destructive",
      "severity": "critical",
      "fragments": ["rm -rf /", "rm -rf ~", "rm -rf /*", "mkfs.", "dd if=", "> /dev/sd"],
      "message": "Potentially destructive filesystem command"
    },
    {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · signatures.json (reported line 79)May include surrounding context.

json

"id": "permission-override",
      "category": "privilege",
      "severity": "medium",
      "fragments": ["chmod 777", "chmod 666"],
      "message": "Overly permissive file permissions"
    },
    {

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · signatures.json (reported line 114)May include surrounding context.

json

"id": "prompt-injection",
      "category": "prompt_injection",
      "severity": "critical",
      "fragments": ["ignore previous instructions", "ignore the above", "ignore all instructions", "override instructions", "you are now"],
      "message": "Potential prompt injection language"
    }
  ]

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md

| `hardcoded-api-key` | secrets | high | Possible hardcoded API key |
| `hardcoded-secret` | secrets | high | Possible hardcoded secret or token |
| `hardcoded-password` | secrets | high | Possible hardcoded password |
| `unsafe-eval` | execution | critical | `eval+()` can execute arbitrary code |
| `unsafe-exec` | execution | critical | `exec+()` can execute arbitrary code |
| `unsafe-os-system` | execution | critical | `os+system()` can execute shell commands |
| `subprocess-shell-true` | execution | high | `subprocess` with `shell=True` is injectable |

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

md

| `hardcoded-api-key` | secrets | high | Possible hardcoded API key |
| `hardcoded-secret` | secrets | high | Possible hardcoded secret or token |
| `hardcoded-password` | secrets | high | Possible hardcoded password |
| `unsafe-eval` | execution | critical | `eval+()` can execute arbitrary code |
| `unsafe-exec` | execution | critical | `exec+()` can execute arbitrary code |
| `unsafe-os-system` | execution | critical | `os+system()` can execute shell commands |
| `subprocess-shell-true` | execution | high | `subprocess` with `shell=True` is injectable |

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · signatures.json (reported line 31)May include surrounding context.

json

| `hardcoded-api-key` | secrets | high | Possible hardcoded API key |
| `hardcoded-secret` | secrets | high | Possible hardcoded secret or token |
| `hardcoded-password` | secrets | high | Possible hardcoded password |
| `unsafe-eval` | execution | critical | `eval+()` can execute arbitrary code |
| `unsafe-exec` | execution | critical | `exec+()` can execute arbitrary code |
| `unsafe-os-system` | execution | critical | `os+system()` can execute shell commands |
| `subprocess-shell-true` | execution | high | `subprocess` with `shell=True` is injectable |

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · signatures.json (reported line 38)May include surrounding context.

json

| `hardcoded-api-key` | secrets | high | Possible hardcoded API key |
| `hardcoded-secret` | secrets | high | Possible hardcoded secret or token |
| `hardcoded-password` | secrets | high | Possible hardcoded password |
| `unsafe-eval` | execution | critical | `eval+()` can execute arbitrary code |
| `unsafe-exec` | execution | critical | `exec+()` can execute arbitrary code |
| `unsafe-os-system` | execution | critical | `os+system()` can execute shell commands |
| `subprocess-shell-true` | execution | high | `subprocess` with `shell=True` is injectable |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises shell-based scanning commands (python3 scripts/vetter.py /path/to/skill) and implies file-reading behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, undeclared capabilities reduce transparency and can cause users or orchestrators to grant broader access than expected, which is risky for a security-themed skill that scans arbitrary local paths.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

| `shell=True` | High | Shell injection risk |
| Hardcoded secrets | High | `auth_token`, `secret` |
| Credential file access | High | `.ssh/`, `.aws/` |
| Sudo elevation | High | `sudo` commands |
| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | `.git/config` reads |
| Password hardcoding | High | `password` literal |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | `.git/config` reads |
| Password hardcoding | High | `password` literal |
| Permission overrides | Medium | `chmod 777` |
| Network calls | Medium | `requests.post()` |

## New in v2.1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · signatures.json (reported line 79)May include surrounding context.

json

| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | `.git/config` reads |
| Password hardcoding | High | `password` literal |
| Permission overrides | Medium | `chmod 777` |
| Network calls | Medium | `requests.post()` |

## New in v2.1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

## New in v2.1

- 10 new detection signatures (pipe-to-shell, sudo escalation, destructive commands, credential file access, base64 obfuscation, git config, permission overrides)
- Skips `node_modules/`, `__pycache__/`, `.git/` (reduced false positives)
- Smarter pipe-to-shell detection (only flags actual pipe patterns)
- Self-scan exclusions (scanner ignores its own signatures file)