T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ctrlz.sh:62- Finding
SQL Injection Through Unvalidated CLI Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
CtrlZ
Security checks for vulnerabilities and agentic risk
Overview
This undo skill is purpose-aligned, but it needs Review because it can overwrite or delete user files from unvalidated stored records without confirmation and keeps plaintext backups.
Review carefully before installing. Use only in disposable or well-backed-up workspaces unless the skill adds path scoping, a dry-run preview, explicit confirmation for undo and clear, SQL/input hardening, and clear handling of retained backups. Do not rely on it to fully reverse package installs or shell command side effects.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ctrlz.sh:171- Finding
Unvalidated Undo Records Permit Arbitrary File Deletion and Overwrite
- Content
View full analysis
"$target_path" else # If no backup, delete file rm -f "$target_path" fi ;; file_delete) # Restore deleted file (if backup exists) if [[ -n "$backup_path" && -f "$backup_path" ]]; then cp "$backup_path" "$target_path" fi ;; dir_create) # Delete created directory if [[ -d "$target_path" ]]; then rm -rf "$target_path" fi ;; exec_install|package_install) # Collect packages to remove, ask user later packages_to_remove+=("$target_path") ;; esac done <<< "$ops" # Mark session as undone sqlite3 "$DB_PATH" "UPDATE undo_sessions SET status = 'undone' WHERE id = $session_id;" ``` ### Technical Analysis The undo implementation treats database fields as trusted filesystem instructions. It does not: - Canonicalize target or backup paths. - Restrict operations to an approved workspace. - Reject `/`, `$HOME`, parent-directory traversal, or other sensitive locations. - Verify that the target still represents the object originally recorded. - Defend against symbolic-link substitution. - Verify database integrity or authenticate operation records. - Require confirmation before recursive deletion. For `dir_create`, the script executes `rm -rf` against the stored path. For file operations, it can delete the target or overwrite it using stored content or an attacker-selected backup. The SQL injection vulnera ...[truncated 1548 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ctrlz.sh:168- Finding
Delimiter-Based SQLite Output Parsing Can Redirect Undo Operations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ctrlz.sh:260- Finding
Sensitive File Backups Lack Secure Permissions and Complete Retention Cleanup
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:16- Finding
Installation Instructions Retrieve an Unpinned Mutable Repository Revision
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill promises automatic, conversation-scoped undo of file changes and installations, but the documented behavior depends on external callers to start sessions and record operations, and package installs are not actually reverted. This mismatch can cause users to rely on rollback guarantees that do not exist, leading to incomplete recovery after destructive actions and a false sense of safety when making changes.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The clear command irreversibly removes all undo metadata and backups with no warning, eliminating the ability to recover prior changes. In the context of an undo system, this is especially dangerous because it defeats the primary safety mechanism and can be triggered as a single destructive action.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The script uses rm -rf to delete the entire backups directory derived from $HOME, with no confirmation or additional guardrails. Even though the path is quoted, this is still a dangerous destructive primitive in a safety-focused skill because environment manipulation, misconfiguration, or accidental invocation can wipe all rollback backups at once.
- Content
sh # Clear all records clear_all() { sqlite3 "$DB_PATH" "DELETE FROM undo_operations; DELETE FROM undo_sessions;" rm -rf "$HOME/.openclaw/skills/ctrlz/backups" echo "{\"cleared\": true}" }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README prominently advertises one-command reversal of file modifications, deletions, and other changes, but does not provide a clear warning that undo may itself be destructive or irreversible if state tracking is incomplete. In practice, users may invoke the feature without understanding that recent edits, created files, or deleted content could be reverted unexpectedly, increasing the chance of data loss or operational disruption.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language triggers include very broad phrases such as "undo" and "ctrl+z", which can appear in ordinary conversation or in ambiguous contexts. In a skill that performs destructive rollback actions, this raises the risk of unintended activation and accidental deletion or reversion of user changes without sufficiently explicit confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description advertises reverting file modifications and installations but does not prominently warn that undo is destructive and may restore older file states or only partially reverse changes. Users may activate it without understanding that important work can be lost or that some effects, such as installs and command side effects, may remain.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language trigger includes the single broad term "undo," which is ambiguous and likely to appear in normal conversation outside a genuine rollback request. In an automation context, this can cause unintended invocation of destructive reversal actions against files or prior work without sufficient user confirmation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill persists undo session data and backups across conversation rounds, creating retained records of file paths, change history, and possibly file contents. While persistence is part of the feature, retaining this data without documented limits, protections, or minimization increases exposure if local storage is accessed by other processes or users.
- Content
text Operation types: - `file_write` - Write/overwrite file - `file_edit` - Edit existing file - `file_delete` - Delete file - `dir_create` - Create directory
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These test cases repeatedly demonstrate destructive undo actions such as deleting files and entire directories, but they do not prominently warn that running them can cause irreversible data loss if paths are mis-specified or reused outside an isolated test environment. In a skill explicitly designed to revert system changes, missing safety warnings materially increases the chance that a user or agent will run destructive examples against real data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Scenario: Set up AI News Agent but config wrong, want to revert everything # 1. Create original file cp ~/.openclaw/cron/jobs.json ~/.openclaw/cron/jobs.json.bak # 2. Start a big session
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ctrlz record $SESSION file_edit ~/.openclaw/cron/jobs.json # ... modify json ... # 4. Create database ctrlz record $SESSION dir_create ~/.openclaw/agents/ai-news-agent echo "CREATE TABLE..." | sqlite3 ~/.openclaw/agents/ai-news-agent/news.db
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The undo routine performs rm -f and rm -rf on recorded paths without user confirmation or path validation. Because the tool is designed to operate automatically in response to 'undo last step', a malformed, stale, or attacker-influenced record could cause deletion of unintended files or directories.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description promises that installations will be reverted automatically, but the implementation only prints suggested uninstall commands and leaves installed packages in place. In an undo tool, this mismatch is security-relevant because users may rely on the skill to roll back environmental changes and falsely assume risky packages or dependencies were removed.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh elif [[ "$pkg" == pip:* ]]; then echo " pip uninstall ${pkg#pip:}" >&2 elif [[ "$pkg" == apt:* ]]; then echo " sudo apt remove ${pkg#apt:}" >&2 else echo " # Package: $pkg" >&2 fi
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The clear command permanently deletes all undo records and backup files, which exceeds the user-facing promise of undoing the last step and destroys recovery data. In a safety tool, including an unrestricted destructive reset path increases the chance of accidental or abusive loss of forensic and rollback state.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh case "$cmd" in init) # Initialize database (auto-executed) echo "{\"initialized\": true, \"db_path\": \"$DB_PATH\"}" ;;
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The run_test helper executes its second argument using eval, which causes the shell to re-parse and execute arbitrary command strings. If any test name, path, or future test input becomes attacker-controlled or improperly escaped, this can lead to command injection and arbitrary code execution during testing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The teardown routine deletes the entire temporary test directory with
rm -rf, which is a destructive operation. Although this is part of cleanup logic, the script provides no prior warning in comments or user-facing output that it will remove files under the generated test path.- Content