T09 · Insecure Skill Coding Practices
Warning
- Location
test_daytona.py:19- Finding
OpenRouter API Key Uploaded in Plaintext to a Third-Party Sandbox
- Content
View full analysis
- Remediation
View remediation
Security audit
Benchmarked Free Ride
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and mostly does what it advertises: it fetches a public model leaderboard and updates OpenClaw model defaults, with optional test scripts that require care around API keys.
Install only if you are comfortable with a skill that fetches public benchmark data and persistently changes OpenClaw's default primary and fallback models. Run the list command first if you want to inspect choices before changing config. Avoid running the Daytona E2E tests with a normal long-lived OpenRouter key; use a scoped disposable test key and pin CLI/package versions when reproducing the documented workflows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
test_clawhub.py:69- Finding
Mutable and Unpinned Third-Party Packages Are Downloaded and Executed
- Content
View full analysis
\ --changelog "" \ --tags latest ``` `test_daytona.py`: ```python # 3. Install openclaw print("\n📦 Installing openclaw...") run(sandbox, "npm install -g openclaw", timeout=180, label="npm") ec, ver = run(sandbox, "openclaw --version", label="version") check("openclaw installed", ec == 0 and "not found" not in ver, ver) ``` `test_clawhub.py`: ```python # 3. Install openclaw print("\n📦 Installing openclaw...") run(sandbox, "npm install -g openclaw", timeout=180, label="npm-openclaw") ec, ver = run(sandbox, "openclaw --version", label="openclaw-ver") check("openclaw installed", ec == 0 and "not found" not in ver, ver) # 4. Install skill from ClawHub print(f"\n📦 Installing skill '{SKILL_SLUG}' from ClawHub...") ec, out = run( sandbox, f"npx clawhub@latest install {SKILL_SLUG} --dir /root/.openclaw/skills", timeout=120, label="clawhub-install", ) check("clawhub install exits 0", ec == 0, out[-300:] if out else "no output") ``` ### Technical Analysis The documented workflows and integration tests retrieve executable third-party packages without pinning exact reviewed versions or verifying package integrity: - `clawhub@latest` explicitly selects a mutable latest release. - `npm install -g openclaw` selects the registry's current matching release. ...[truncated 2231 chars]- Remediation
View remediation
`. 2. Pin `openclaw` and `daytona-sdk` to exact versions validated by the project. 3. Commit npm and Python lockfiles and use reproducible installation commands such as `npm ci`. 4. For Python dependencies, use a requirements file containing exact versions and cryptographic hashes, then install with hash enforcement. 5. Verify registry provenance, package signatures, checksums, and publisher identity before executing newly released versions. 6. Disable package lifecycle scripts where they are unnecessary and supported by the package manager. 7. Run package installation with a non-root sandbox user and restrict filesystem and network access to the minimum required for the tests. 8. Separate tests that require credentials from dependency-installation stages so newly downloaded code does not automatically receive sensitive tokens. 9. Introduce an explicit dependency-update review process rather than resolving mutable releases during every installation or test run. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
The leaderboard has no models matching
:free+is_benchmarked == true. Check the live data:bash curl -s "https://sequrity-ai.github.io/benchmarked-free-ride-ci/api/leaderboard.json" | python3 -c " import sys, json d = json.load(sys.stdin) free = [m for m in d['leaderboard'] if ':free' in m.get('model_id','') and m.get('is_benchmarked')]
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description frames the skill as selecting or recommending models, but the content explicitly supports automatic reconfiguration of OpenClaw defaults and fallbacks. This mismatch is dangerous because it can mislead users and orchestrators into granting trust to what appears to be an advisory skill, when it actually performs persistent local changes and network access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description frames the skill as selecting or recommending models, but the content explicitly supports automatic reconfiguration of OpenClaw defaults and fallbacks. This mismatch is dangerous because it can mislead users and orchestrators into granting trust to what appears to be an advisory skill, when it actually performs persistent local changes and network access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description frames the skill as selecting or recommending models, but the content explicitly supports automatic reconfiguration of OpenClaw defaults and fallbacks. This mismatch is dangerous because it can mislead users and orchestrators into granting trust to what appears to be an advisory skill, when it actually performs persistent local changes and network access.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file creates a Daytona sandbox, installs system packages with apt, installs npm packages globally, and installs the skill into the remote environment. A skill whose stated purpose is to recommend benchmarked free models does not inherently require remote environment provisioning or package installation; that is a separate orchestration capability.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Config directory not writable. Ensure
~/.openclaw/exists:bash mkdir -p ~/.openclaw
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares network and file-write behavior in metadata but does not define an explicit tool/permission scope such as allowed-tools or permissions. That creates an authorization ambiguity: a user may expect a recommendation-only skill, while the implementation can fetch remote data and persistently modify local configuration, increasing the chance of overbroad execution in an agent environment.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > - **default** — best overall task accuracy (composite score) > - **--secure** — most resistant to prompt injection attacks" If the user's request implies a preference (e.g. "safest", "most secure", "best overall"), infer the mode without asking. ## Data Source
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill reads and writes persistent state in ~/.openclaw/openclaw.json, causing model selection changes to survive beyond the current invocation. In this context, persistence matters because remotely sourced model IDs can influence future agent runs, creating a durable configuration-manipulation risk if the remote data source is wrong, compromised, or unexpected.
- Content
python with_score.sort(key=lambda m: m["cracker_security_rate"], reverse=True) return with_score + without_score # ── Config read/write ───────────────────────────────────────────────────── def _read_config(self) -> dict: """Read current OpenClaw config."""
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill does more than recommend models: it directly rewrites the user's persistent OpenClaw configuration file based on remotely fetched leaderboard data. This creates a trust-boundary issue because running a seemingly advisory skill can silently change future agent behavior and persist those changes across sessions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The installation step uses
npx clawhub@latest install benchmarked-free-ride, which pulls and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised, typosquatted, or a malicious update is published, arbitrary code could run on the user's machine during installation.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for choosing free OpenRouter models from live benchmark results, but this file also reads Daytona and OpenRouter API credentials and, when available, provisions infrastructure and makes a live agent call through OpenRouter. Those capabilities are not necessary to justify the core purpose of ranking and recommending free models; they are auxiliary integration-test behaviors with broader external access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The script executes
npx clawhub@latest install ..., which pulls and runs the latest package version at test time without pinning or integrity verification. This creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code inside the sandbox and influence the installed skill or test results.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Beyond ranking or listing models, this test invokes the skill's auto and switch flows and verifies that /root/.openclaw/openclaw.json is modified to set primary and fallback models. Automatically reconfiguring another tool's runtime model selection is a stronger capability than merely recommending performance-ranked free models, and the manifest description does not mention configuration mutation.
- Content
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
python def upload_file(sandbox, local_path, remote_path): """Upload a local file into the sandbox.""" with open(local_path, "rb") as f: sandbox.fs.upload_file(f.read(), remote_path) print(f" uploaded {local_path} -> {remote_path}")
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
python def upload_file(sandbox, local_path, remote_path): """Upload a local file into the sandbox.""" with open(local_path, "rb") as f: sandbox.fs.upload_file(f.read(), remote_path) print(f" uploaded {local_path} -> {remote_path}")
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
python def upload_file(sandbox, local_path, remote_path): """Upload a local file into the sandbox.""" with open(local_path, "rb") as f: sandbox.fs.upload_file(f.read(), remote_path) print(f" uploaded {local_path} -> {remote_path}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script embeds OPENROUTER_API_KEY into a config file and uploads it into a remote Daytona sandbox. Even though this appears intended for end-to-end testing, the credential is transferred into another execution environment without any explicit user confirmation, minimization, or lifecycle controls shown here. If the sandbox is compromised, misconfigured, retained longer than expected, or its filesystem/logs are accessible, the API key could be exposed and abused.
- Content
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This upload sends a generated openclaw configuration containing OPENROUTER_API_KEY into the sandbox filesystem. Unlike the other upload cases, this one transfers a real secret to remote storage, creating risk of credential exposure through sandbox compromise, residual files, or platform-side access.
- Content
python } config_json = json.dumps(openclaw_config, indent=2) sandbox.fs.upload_file(config_json.encode("utf-8"), "/root/.openclaw/openclaw.json") print(f" wrote openclaw.json with OpenRouter provider + {len(all_model_ids)} models") # Send a simple prompt through openclaw
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code performs a real outbound API call from the sandbox through openclaw to OpenRouter. In a testing harness this may be expected, but it still causes external network activity and potential data disclosure without an explicit warning or consent gate at the point of use. If prompts or config contain sensitive data, that data may be sent to a third-party service.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level docstring frames the skill as auto-configuring the best free AI models based on benchmarked quality scores and distinguishes that from proxy metrics. Yet the implementation includes a --secure mode and a dedicated security-based sorter using cracker_security_rate, which is a different selection criterion than the documented benchmark-score basis.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The stated purpose centers on using live benchmark CI results to recommend performance-ranked free models and explicitly excludes offline environments. However, commands such as status and config update helpers operate entirely on local configuration data and can be used independently of live recommendation output, broadening the skill beyond the narrowly described benchmark-selection role.
- Content
Static analysis
No suspicious patterns detected.