ClawHub
Back to skill

Security audit

opencli-sitemap-author

Security checks for vulnerabilities and agentic risk

Overview

This skill persistently records OpenCLI site navigation knowledge, but the behavior is disclosed, scoped to sitemap authoring, and includes clear limits against storing secrets or private account data.

Install this if you want OpenCLI agents to reuse site navigation and workflow knowledge across sessions. Review or clean ~/.opencli/sites/<site>/sitemap/ and related traces if the site involves sensitive internal URLs or private workflows, and avoid promoting local drafts until checked for private details.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Content
2. **Verify reality**: use `opencli browser <session> state`, `find`, `network`, and `analyze`; browser state is truth. If you just completed an `opencli-adapter-author` session for this site, start from the retained browse trace under `~/.opencli/sites/<site>/traces/` as seed evidence instead of re-discovering the path from zero.
3. **Record only durable structure**: page purpose, stable anchors, state signature, actions, workflows, API references, pitfalls.
4. **Use stable ids**: page/action/workflow ids should survive URL params, locale text drift, and minor layout changes.
5. **Write local draft**: update `~/.opencli/sites/<site>/sitemap/...` unless explicitly promoting to repo.
6. **Mark stale on conflict**: if existing sitemap disagrees with current browser state, trust browser state and mark the item stale rather than forcing the old path.

---
Confidence
86% confidence
Finding
The skill explicitly directs persistence of locally discovered site data and reuse of retained traces under `~/.opencli/sites/<site>/traces/` and `.../sitemap/`. Even though the skill says not to store secrets, session traces and local drafts can easily capture sensitive browsing context, internal URLs, identifiers, or state that later agents can access, creating cross-session data retention and unintended disclosure risk.

Session Persistence

Medium
Category
Rogue Agent
Content
Use this compact form by default. Use the longer Markdown form from `references/sitemap-schema.md` only when an action genuinely needs long explanation. `verified_at` and `source` are inherited from file frontmatter; do not repeat them per action.

Do not promote an action without evidence. If a recovery path marks `adapter_health_update`, the browser-sitemap consumer must write that health update to the local overlay so the next agent does not retry a known-suspect adapter.

### Partial pages（跨页通用 UI）
Confidence
82% confidence
Finding
This instruction requires writing adapter health updates to a shared local overlay for future agents, creating persistent cross-session state. While useful operationally, shared state can leak prior activity patterns and can be poisoned or become stale, influencing future agent behavior based on untrusted historical data.

Static analysis

No suspicious patterns detected.