ClawHub
Back to skill

Security audit

Ao Op

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent local wrapper for a user’s Agent Orchestrator checkout, with a real but disclosed supply-chain/update risk.

Install only if you control and trust the referenced local Agent Orchestrator checkout. Treat ao.sh update, pnpm install, and pnpm build as code execution from that repository and its dependencies; review the Git remote and changes first, and avoid using this on unrelated machines because the paths are hardcoded to one user environment.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:77
Finding

Unpinned External Source Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:77-83; scripts/ao.sh:3-5
Vulnerability Type: Execution of mutable, externally maintained source code without revision or integrity verification
Risk Level: Medium

Vulnerable Code

SKILL.md:77-83:

bash
Update from source with:

```bash
cd /Users/ShiXin/Documents/Workspace/github-project/agent-orchestrator
git pull --ff-only
pnpm install
pnpm -r build
text

`scripts/ao.sh:3-5`:

```bash
PROJECT_DIR="/Users/ShiXin/Documents/Workspace/github-project/agent-orchestrator"
cd "$PROJECT_DIR"
exec node packages/ao/bin/ao.js "$@"

Technical Analysis

The documented maintenance procedure retrieves the latest content from a configured Git remote and subsequently installs dependencies and executes build scripts. It does not pin the external Agent Orchestrator repository to a reviewed commit or verify the repository origin, commit signature, or expected content hash.

Both pnpm install and pnpm -r build can execute package lifecycle or build scripts supplied by the retrieved project and its dependencies. The wrapper then directly executes packages/ao/bin/ao.js from this mutable checkout. Consequently, the effective executable payload may change after the Skill itself has been reviewed.

The use of --ff-only prevents non-fast-forward merges but does not establish trust in the fetched commits. It does not protect against a compromised upstream repository, malicious changes pushed to an authorized branch, a manipulated local Git remote, or compromised dependency sources.

The wrapper correctly quotes PROJECT_DIR and forwards arguments using "$@"; no direct shell argument-injection vulnerability was identified in the wrapper itself.

Attack Path

  1. An attacker compromises the configured Agent Orchestrator upstream repository, an authorized publishing account, a dependency source, or the local checkout and its Git remote conf ...[truncated 1443 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Agent Orchestrator to an explicitly approved commit hash or signed release rather than automatically executing the latest branch state.
  2. Verify that the Git remote URL matches an allowlisted repository before fetching or executing updates.
  3. Require cryptographic verification of signed commits, signed tags, or release artifacts.
  4. Compare the checked-out commit against an approved revision before every invocation of scripts/ao.sh.
  5. Commit and review a dependency lockfile, then use pnpm install --frozen-lockfile to prevent unreviewed dependency resolution changes.
  6. Audit package lifecycle scripts and consider installing with scripts disabled where operationally possible.
  7. Require explicit user confirmation before source updates, dependency installation, or build-script execution.
  8. Run update and build operations in a sandbox or minimally privileged environment with restricted filesystem, credential, and network access.
  9. Prefer bundling a reviewed executable version with the Skill when licensing and deployment constraints permit it.
  10. Fail closed if repository origin, revision, signature, lockfile integrity, or expected source hashes cannot be verified.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep