CLI-Anything for OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent CLI harness builder, but it tells the agent to trust an unaudited file outside the skill package as authoritative instructions.

Install only if you trust the surrounding CLI-Anything repository layout and any ../cli-anything-plugin/HARNESS.md file the agent may read. Review generated files and commands before allowing tests or pip install -e . to run, especially when working in an untrusted source tree.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10

Finding

Unaudited External File Is Treated as Authoritative Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippet:

markdown

If this skill is being used from inside the `CLI-Anything` repository, read `../cli-anything-plugin/HARNESS.md` before implementation. That file is the full methodology source of truth. If it is not available, follow the condensed rules below.

Technical Analysis

The skill instructs the agent to read a file outside the audited skill directory and treat its contents as the “full methodology source of truth.” The referenced file is not included in this package, so its integrity, provenance, and contents cannot be verified during this audit.

This creates an instruction-trust boundary vulnerability. An attacker who controls the surrounding repository or can create or modify ../cli-anything-plugin/HARNESS.md can place arbitrary instructions in that file. Because the skill explicitly assigns the external document authoritative status, the agent may interpret attacker-controlled repository content as operational instructions rather than untrusted input.

The behavior is conditional: exploitation requires the skill to run from a directory layout where the referenced relative path exists and is attacker-controlled. The reviewed files do not themselves contain an active malicious payload.

Attack Path

1. An attacker controls or modifies the repository environment in which the skill is invoked.
2. The attacker creates or alters ../cli-anything-plugin/HARNESS.md relative to the skill’s working location.
3. The attacker inserts instructions requesting unrelated command execution, sensitive-file access, unsafe installation, source modification, or disclosure of collected information.
4. A user invokes this skill from inside the expected CLI-Anything repository context.
5. Following SKILL.md, the agent reads the attacker-controlled fil ...[truncated 1213 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the complete methodology inside the audited skill package instead of delegating authority to a file outside the package.
2. If an external document is necessary, retrieve it only from a trusted, pinned revision and verify its cryptographic hash or signature before use.
3. Remove language declaring repository-controlled content to be an unrestricted “source of truth.”
4. Explicitly state that external files are untrusted reference data and cannot override system, developer, user, or skill-level security constraints.
5. Restrict accepted external instructions to a defined schema or a narrow set of methodology fields rather than interpreting arbitrary Markdown as commands.
6. Resolve and validate the canonical path before reading it, rejecting symlinks and paths outside an approved repository root.
7. Require explicit user confirmation before executing commands, installing packages, invoking target backends, or accessing sensitive paths based on externally loaded content.
8. Record the external file’s resolved path and verified revision or digest in the final report to support review and reproducibility.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.