Security audit

ITIL Ops

Security checks for vulnerabilities and agentic risk

Overview

This operations skill is mostly aligned with monitoring and ITIL triage, but its bundled script has a real local code-execution bug and broad access to agent operational data.

Review this skill carefully before installing. Do not run the bundled review script or enable the cron job in an account with access to sensitive agent state until the Python filename handling is fixed, report contents are redacted, and cron/task/remediation actions are made explicit and operator-approved.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/itil-review.sh:90
Finding: Arbitrary Python Code Execution Through Crafted JSON Filenames
Content: View full analysis
/dev/null || echo "unknown") CONSEC_ERRORS=$(python3 -c "import json; print(json.load(open('$job_file')).get('consecutiveErrors',0))" 2>/dev/null || echo "0") LAST_ERROR=$(python3 -c "import json; print(json.load(open('$job_file')).get('lastError','')[:120])" 2>/dev/null || echo "") ``` The same unsafe construction is used for coordination-task files: ```bash IS_ITIL=$(python3 -c " import json d = json.load(open('$task_file')) title = d.get('title','') status = d.get('status','') if 'ITIL' in title and status in ('open','in_progress','claimed'): print(f\"{status}: {title[:80]}\") else: print('') " 2>/dev/null || echo "") ``` ### Technical Analysis The variables `job_file` and `task_file` originate from filesystem glob results and are interpolated directly into Python programs supplied through `python3 -c`. Shell quoting protects these values only while the shell constructs the command; it does not safely encode them as Python string literals. A filename containing a single quote and suitable Python syntax can terminate the intended `open('...')` expression and inject additional Python statements. When the review script runs, the injected statements are interpreted by Python with the privileges of the user executing the script. The vulnerable directories are: - `~/.openclaw/cron/jobs` - `~/.skcapstone/coordination/tasks` The `.json` suffix requirement does not prevent exploitation because executable Python syntax can be embedded before the suffix. ### Attack Path 1. An attacker obtains the ability to create or rename a file in either monitored directory. 2. The attacker creates a `.json` file who ...[truncated 1239 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/itil-review.sh:83
Finding: Overbroad Collection and Reporting of Sensitive Agent Operational State
Content: View full analysis
/dev/null || echo "unknown") CONSEC_ERRORS=$(python3 -c "import json; print(json.load(open('$job_file')).get('consecutiveErrors',0))" 2>/dev/null || echo "0") LAST_ERROR=$(python3 -c "import json; print(json.load(open('$job_file')).get('lastError','')[:120])" 2>/dev/null || echo "") ``` It traverses all configured memory tiers: ```bash BROKEN_MEM=0 for tier in short-term mid-term long-term; do tier_dir="$AGENT_HOME/memory/$tier" [ -d "$tier_dir" ] || continue broken=$(python3 -c " import json, glob, os count = 0 for f in glob.glob('$tier_dir/*.json'): try: d = json.load(open(f)) if isinstance(d.get('content'), dict): count += 1 except: pass print(count) " 2>/dev/null || echo "0") BROKEN_MEM=$((BROKEN_MEM + broken)) done ``` It also reads coordination-task titles and statuses: ```bash OPEN_ITIL=0 ITIL_SUMMARY="" if [ -d "$COORD_DIR" ]; then for task_file in "$COORD_DIR"/*.json; do [ -f "$task_file" ] || continue IS_ITIL=$(python3 -c " import json d = json.load(open('$task_file')) title = d.get('title','') status = d.get('status','') if 'ITIL' in title and status in ('open','in_progress','claimed'): print(f\"{status}: {title[:80]}\") else: print('') " 2>/dev/null || echo "") ``` ### Technical Analysis The review process accesses several potentially sensitive sources under the agent account: - OpenCl ...[truncated 2321 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs use of shell commands, state-file writes, cron scheduling, and coordination task creation, but it declares no explicit tool scope or permission boundaries. That omission increases the chance an agent invokes powerful capabilities without least-privilege constraints or human awareness, especially because the documented workflows include service inspection and operational changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation guidance is broad enough to trigger on many normal operational situations, including generic failures, audits, and review pipelines, without strong limits on when the skill should only observe versus when it may recommend or perform changes. In an autonomous setting, overly broad routing can cause the skill to be selected in contexts where shell access, state tracking, or remediation logic is unnecessary or unsafe.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automated remediation, ticket creation, cron setup, and maintenance of itil-state.json without a clear warning that these actions mutate the environment and may affect service behavior. Because the same document also defines incident and change workflows, an agent could infer authority to take impactful operational actions automatically rather than limiting itself to reporting findings.
Content: No source excerpt is available for this finding.