T09 · Insecure Skill Coding Practices
Warning
- Location
lib/resumption.js:36- Finding
Path Traversal Through Insufficiently Validated Session Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
Tide Watch
Security checks for vulnerabilities and agentic risk
Overview
Tide Watch is mostly a local OpenClaw session-management tool, but its optional CLI has a real path-validation weakness and the package overstates some automatic backup/reset behavior.
Prefer the directives-only mode unless you specifically need the CLI. Do not pass untrusted or hand-crafted session IDs to the CLI, avoid archive/delete operations without dry-run review, and wait for a version that enforces strict UUID validation and path containment if you need the optional CLI on sensitive workspaces.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (84)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' });
YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ailed to open editor: ${error.message}`); return false; } }
text ### Vulnerability Type **CWE-78:** Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ### Attack Vector An attacker who can control the `sessionId` parameter could inject shell metacharacters to execute arbitrary commands. Example: ```javascript // Malicious sessionId sessionId = '"; rm -rf / #' // Resulting command (before v1.0.1 fix) execSync(`nano "/path/to/"; rm -rf / #.md"`, { stdio: 'inherit' }); // This would execute: nano /path/to/ // rm -rf /Exploitability
Likelihood: LOW to MEDIUM
Reasons:
-
Requires user invocation: The vulnerable function is only called when a user explicitly runs:
bash tide-watch resume-prompt edit --session <session-id> -
Session ID source: Session IDs are typically UUIDs generated by OpenClaw, not user-controlled strings. However, the CLI accepts arbitrary input via the `--
-
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
tide-watch resume-prompt edit --session 6eff94ac-dde7-4621-acaf-66bb431db822
Vulnerable usage (malicious)
tide-watch resume-prompt edit --session '"; rm -rf ~ #'
text A malicious user or script could exploit this to execute commands.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md > > **What it can do:** Write reminders to your workspace memory folder, help you back up conversations before resetting. > > **What it cannot do:** Read your files outside the workspace, access credentials, send data anywhere, or run code on your system. > > **Bottom line:** This is an instruction-only monitoring tool with zero external access. Installing it is like adding a reminder system—it helps you manage your own data without touching anything sensitive.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Other CLI tools with config files:** - Git: `~/.gitconfig` (0644) - npm: `~/.npmrc` (0644) - Docker: `~/.docker/config.json` (0600) - AWS CLI: `~/.aws/config` (0600)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Other CLI tools with config files:** - Git: `~/.gitconfig` (0644) - npm: `~/.npmrc` (0644) - Docker: `~/.docker/config.json` (0600) - AWS CLI: `~/.aws/config` (0600) **Tide Watch follows industry patterns:**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Git: `~/.gitconfig` (0644) - npm: `~/.npmrc` (0644) - Docker: `~/.docker/config.json` (0600) - AWS CLI: `~/.aws/config` (0600) **Tide Watch follows industry patterns:** - ✅ User home directory config
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md **This skill does NOT:** - ❌ Access files outside OpenClaw sessions directory - ❌ Transmit data to external servers - ❌ Require any API keys or credentials - ❌ Modify system configuration
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code aligns with several declared features: it inspects session capacity, filters/sorts sessions, shows dashboard/report/status output, archives sessions on demand, and manages resumption prompt artifacts (edit/show/list/test/delete/enable/disable/discovery state). But important parts of the description overstate behavior. The implementation is a command-line utility invoked manually; there is no evidence of autonomous/proactive monitoring except an optional interactive dashboard watch loop. Thresholds 75/85/90/95 are used for display/recommendation logic, but not for automatic warning delivery or enforcement. Archiving exists, but only as an explicit CLI command, not as automatic backup before resets. The resumption feature manages prompt files and settings, but does not itself reset sessions or automatically resume them. Thus the description is materially broader than the supplied code chunk's actual capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code substantially matches the core monitoring aspect of the description: it parses OpenClaw session JSONL files, calculates token usage against context limits, applies threshold-based status categories aligned with 75/85/90/95%, supports dashboards, filtering, archive operations, and some multi-agent/channel awareness. However, several declared capabilities are not implemented in this chunk. There is no logic for automatic backup-before-reset workflows, no reset execution, and no session resumption prompt management. The archive feature moves session files into archive folders and updates the registry, but that is not clearly the same as automatic backup before reset. The claim of supporting any model or provider is also broader than the code, which is tightly coupled to OpenClaw directories, config files, and CLI commands, with only fallback model-limit mappings. Because the code is primarily OpenClaw session monitoring plus manual archiving/dashboard support, the description overstates functionality and portability enough to count as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on preventing context-window lockups and managing long-running chat sessions. The supplied code does none of that. It only loads, validates, and saves configuration values for refresh/gateway intervals and timeouts, using defaults, environment variables, CLI flags, and a config file under ~/.config/tide-watch/config.json. While configuration handling could be a supporting component in a larger system, this chunk's actual purpose is materially different from the declared skill purpose and references a different tool/domain ('Tide Watch' gateway/dashboard timing) rather than OpenClaw session-capacity management.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad session-capacity management system centered on preventing context window lockups, issuing warnings, backing up sessions, and offering dashboards/archive tools. The supplied code only covers one narrower subset: management of resumption prompt files stored under the user's home directory, including editing, status reporting, enable/disable markers, and a discovery toggle. Although there are references in display text to capacity warning reminders and auto-load on reset, there is no code here that actually monitors context usage, triggers threshold alerts, performs backups, or manages archives/dashboards. Therefore the description materially overstates the implemented behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description emphasizes proactive monitoring of context capacity and prevention of context-window lockups, including threshold warnings, automatic backups, reset handling, dashboards, and cross-channel management. The actual code chunk does not implement or test any of those behaviors. Instead, it focuses narrowly on resume prompt persistence and metadata via local markdown files: path generation, existence checks, loading with default fallback, saving, deleting, listing, template generation, and token/line estimation. Session resumption prompts are mentioned in the description, so this code may support one sub-feature, but the primary purpose and most advertised capabilities are absent from this chunk. Therefore the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description centers on monitoring context window capacity and managing backups/resets/resumption workflows. The supplied code does not implement or test any of those behaviors. Instead, it tests a different feature: resolving session IDs from user-provided selectors such as labels and channels. While session resolution could be a supporting utility inside a larger session-management system, this specific chunk is materially focused on lookup semantics and ambiguity handling, not proactive capacity monitoring or backup/reset management. Therefore the code chunk does not accurately represent the declared primary purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Review `lib/capacity.js` and `lib/resumption.js`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This is another duplicate variant of the same
rm -rf ~/clawd/skills/tide-watchcommand. The concern is not malicious code execution but unsafe documentation that normalizes force-delete commands in a context where users may blindly paste them.- Content
md **Remove from workspace:** 1. Delete the Tide Watch section from `~/clawd/AGENTS.md` 2. Delete the Tide Watch section from `~/clawd/HEARTBEAT.md` 3. (Optional) Remove skill folder: `rm -rf ~/clawd/skills/tide-watch` 4. (Optional) Unlink CLI: `npm unlink tide-watch` **Clean up data:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This is another duplicate variant of the same
rm -rf ~/clawd/skills/tide-watchcommand. The concern is not malicious code execution but unsafe documentation that normalizes force-delete commands in a context where users may blindly paste them.- Content
md **Remove from workspace:** 1. Delete the Tide Watch section from `~/clawd/AGENTS.md` 2. Delete the Tide Watch section from `~/clawd/HEARTBEAT.md` 3. (Optional) Remove skill folder: `rm -rf ~/clawd/skills/tide-watch` 4. (Optional) Unlink CLI: `npm unlink tide-watch` **Clean up data:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This is another duplicate variant of the same
rm -rf ~/clawd/skills/tide-watchcommand. The concern is not malicious code execution but unsafe documentation that normalizes force-delete commands in a context where users may blindly paste them.- Content
md **Remove from workspace:** 1. Delete the Tide Watch section from `~/clawd/AGENTS.md` 2. Delete the Tide Watch section from `~/clawd/HEARTBEAT.md` 3. (Optional) Remove skill folder: `rm -rf ~/clawd/skills/tide-watch` 4. (Optional) Unlink CLI: `npm unlink tide-watch` **Clean up data:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
This duplicate finding points to the same backup-deletion command and remains valid on the merits. The risk is accidental or uninformed irreversible deletion of stored backup data.
- Content
Clean up data:
bash rm -rf ~/.openclaw/agents/main/sessions/backups/ rm -rf ~/.openclaw/agents/main/sessions/archive/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
This duplicate finding points to the same backup-deletion command and remains valid on the merits. The risk is accidental or uninformed irreversible deletion of stored backup data.
- Content
Clean up data:
bash rm -rf ~/.openclaw/agents/main/sessions/backups/ rm -rf ~/.openclaw/agents/main/sessions/archive/
Static analysis
Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/capacity.js:155
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/resumption.js:176
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- docs/FAQ.md:358