ClawHub
Back to skill

Security audit

opencli-autofix

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate adapter-repair purpose, but it gives the agent broad local edit authority based on trace-provided paths and can publish diagnostic details to GitHub.

Install only if you are comfortable letting the agent edit OpenCLI adapter source files. Before use, verify that any adapterSourcePath resolves inside the OpenCLI adapter directories, review diffs before edits, and redact tokens, cookies, private URLs, usernames, and local paths before approving any GitHub issue.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:159
Finding

Unvalidated Trace-Controlled Path Permits Modification of Arbitrary User Files

Content
View full analysis
/` in repo or `~/.opencli/clis//` for npm installs) - **Never modify** `src/`, `extension/`, `tests/`, `package.json`, or `tsconfig.json` ``` ```markdown Read `summaryPath` first. It is the LLM-oriented entry point and includes front matter: ```yaml --- schemaVersion: 1 opencliVersion: "..." traceId: "..." status: failure site: "example" command: "example/search" adapterSourcePath: "/path/to/clis/example/search.js" errorCode: "SELECTOR" errorMessage: "Could not find element: .old-selector" --- ``` ``` ```markdown Read the adapter source file at `adapterSourcePath` from the trace summary front matter and make targeted fixes. This path is authoritative — it may be in the repo (`clis/`) or user-local (`~/.opencli/clis/`). Use the `Read` tool on the exact path from summary.md front matter. ``` ### Technical Analysis The Skill treats `adapterSourcePath`, a value obtained from a trace artifact, as an authoritative filesystem location. It instructs the Agent to read and modify the exact referenced file without requiring: - Canonicalization of the supplied path. - Validation that the resolved path remains inside an approved adapter directory. - Rejection of path traversal sequences. - Rejection of symbolic links. - Validation of the expected adapter file extension or structure. - Explicit confirmation of the fully resolved target before modification. The rule that only one file may be modified does not enforce a meaningful security boundary. If the trace is malformed, compromised, or attacker-controlled ...[truncated 1805 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:225
Finding

Trace-Derived Issue Content Can Cause Shell Injection and Sensitive Information Disclosure

Content
View full analysis
/: ` (e.g. `[autofix] zhihu/hot: SELECTOR`) - **Body** (use this template): ```markdown ## Summary OpenCLI autofix repaired this adapter locally, and the retry passed. ## Adapter - Site: `` - Command: `` - OpenCLI version: `` ## Original failure - Error code: `` ~~~ ~~~ ## Local fix summary ~~~ <1-2 sentence description of what you changed and why> ~~~ _Issue filed by OpenCLI autofix after a verified local repair._ ``` 2. **Ask the user before filing.** Show them the draft title and body. Only proceed if they confirm. 3. If the user approves and `gh auth status` succeeds: ```bash gh issue create --repo jackwener/OpenCLI \ --title "[autofix] /: " \ --body "" ``` ``` ### Technical Analysis The Skill directs the Agent to construct a GitHub issue from trace-derived fields, including the site, command, error code, and full error message. It then demonstrates passing the resulting content directly into a double-quoted shell argument. Double quotes do not neutralize every Bash metacharacter. In particular, command substitutions using `$(...)` or backticks can still be evaluated if an Agent constructs and executes the command through shell interpolation. A malicious or compromised website, adapter, or trace artifact could therefore place shell syntax in an error message or another interpolated field. The same workflow sends trace-derived information to a public or externally hosted GitHub repository. Error messages can contain local paths, URLs with query parameters, accou ...[truncated 2437 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill is granted persistent modification capabilities via Edit and Write, and its workflow instructs the agent to patch local adapter source files automatically after command failures. Because the skill operates on paths derived from trace metadata and supports modifying user-local adapter directories, a compromised or incorrect trace context could lead to unintended persistent code changes in the user's environment.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: opencli-autofix
description: Automatically fix broken OpenCLI adapters when commands fail. Load this skill when an opencli command fails — it guides you through collecting a trace artifact, patching the adapter, retrying, and filing an upstream GitHub issue after a verified fix. Works with any AI agent.
allowed-tools: Bash(opencli:*), Bash(gh:*), Read, Edit, Write
---

# OpenCLI AutoFix — Automatic Adapter Self-Repair

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
If you redirected stderr to a file, read that file and copy `trace.summaryPath`.

Do not ask the user to rerun with legacy diagnostic env vars. Trace is the repair evidence path.

## Step 2: Analyze the Failure

Static analysis

No suspicious patterns detected.