T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Automatic Repository Modification and Push Using Ambient Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Use Case Catalog
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a use-case catalog, but it tells the agent to browse, write findings, commit, and push to a repository without a clear approval step.
Review this before installing. Treat it as a Review item because it can publish generated findings to Git using your existing credentials. Only use it where repository writes are intended, require confirmation before web research, file writes, commits, or pushes, and avoid adopting examples involving SMS 2FA, private-message monitoring, real-browser platform evasion, or autonomous production changes without explicit consent, scoped accounts, audit logs, and human approval.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
findings/2026-02-05-leo-personalized.md:198- Finding
Unsafe Webhook-Controlled Branch Handling and Predictable Temporary Directory
- Content
View full analysis
/tmp/analysis.txt cppcheck --enable=all src/ 2> /tmp/cppcheck.txt ``` ### Technical Analysis The example describes a GitHub-webhook workflow in which a branch value is passed to a shell script. `PR_BRANCH` is expanded without quotation or validation. This permits shell word splitting and pathname expansion, and a crafted value containing additional words can alter the arguments supplied to `git clone`. The fixed `/tmp/rose-pr` directory is also unsafe: - Concurrent webhook jobs use the same location. - A previous failed or interrupted job may leave stale content. - Another local process may pre-create or manipulate the path. - The script does not remove the directory before cloning. - The script does not stop when `git clone` or `cd` fails. Because the script lacks `set -e`, a failed clone can be followed by a successful `cd` into preexisting content. Static-analysis tools may then process files different from the intended pull request. The predictable output files `/tmp/analysis.txt` and `/tmp/cppcheck.txt` present similar collision and replacement risks. ### Attack Path 1. An attacker opens or updates a pull request that triggers the documented webhook workflow. 2. The webhook-derived branch value is passed as the script's first argument. 3. The unquoted expansion undergoes word splitting or glob expansion and can change the effective `git clone` arguments. 4. Alternatively, the clone fails because `/tmp/rose-pr` already exists or because the supplied branch is invalid. 5. Since the script does not terminate on failure, execution continues. 6. The s ...[truncated 1067 chars]- Remediation
View remediation
/dev/null WORKDIR=$(mktemp -d) trap 'rm -rf -- "$WORKDIR"' EXIT REPO_DIR="$WORKDIR/repository" ANALYSIS_FILE="$WORKDIR/analysis.txt" CPPCHECK_FILE="$WORKDIR/cppcheck.txt" git clone \ --depth 1 \ --branch "$PR_BRANCH" \ --single-branch \ "https://github.com/{github_user}/rose.git" \ "$REPO_DIR" cd -- "$REPO_DIR" clang-tidy src/**/*.cpp > "$ANALYSIS_FILE" cppcheck --enable=all src/ 2> "$CPPCHECK_FILE" ``` Additional hardening should include: 1. Derive the repository and commit SHA from a validated webhook payload rather than accepting arbitrary command-line values. 2. Validate GitHub webhook signatures before processing events. 3. Fetch and check out an immutable commit SHA instead of trusting a mutable branch name. 4. Allowlist repositories and repository owners. 5. Run analysis in an isolated container with no ambient secrets and a read-only filesystem where practical. 6. Apply CPU, memory, process, and execution-time limits. 7. Prevent loading repository-supplied plugins or untrusted analyzer configuration. 8. Keep each webhook job in a unique workspace and never reuse stale state. ]]>
other
Note
- Location
findings/2026-02-12.md:21- Finding
Guidance for Evading Platform Browser-Automation Detection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad everyday terms such as 'ideas,' 'examples,' and 'what people do,' which can cause the skill to activate in unrelated conversations. Because this skill also instructs web searching and repo updates, accidental invocation could lead to unnecessary external actions or content generation without clear user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is described as a passive use-case catalog, but its instructions direct the agent to perform fresh web research, write files, and push commits to a repository. That expands the skill from read-only reference behavior into active external interaction and code-repo modification, which increases the chance of unintended network access, data ingestion, and unauthorized publication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction "All findings MUST be bilingual" and "Chinese first" imposes a specific language and ordering requirement regardless of user preference. This is a natural-language policy concern because it forces a locale/language behavior without offering a choice or documenting a justified regional constraint.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Phone-Based Development**: Build and deploy code projects from WhatsApp/Telegram while on the go. (@christinetyip) - **Site Rebuilds from Bed**: Full website migration (Notion to Astro, 18 posts, DNS to Cloudflare) via Telegram while watching Netflix. (@davekiss) - **Auto-Deployment**: "Deploy the latest commit to staging" -- runs git commands, SSH scripts, handles the pipeline. - **Code Refactoring**: Scan directories, identify messy code, propose refactored versions. - **Server Monitoring**: Periodic htop/disk checks, alert via Telegram when under load. - **GitHub Workflow**: Manage Issues, PRs, CI runs, auto-assign/label/close via webhooks.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The DevOps example describes autonomous triage and response to production issues with no caution about change control, blast radius, or destructive actions. In this context, the omission is risky because readers may infer that unattended remediation in production is an endorsed default, increasing the chance of outages or harmful system modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The catalog promotes fully autonomous coding, testing, bug fixing, and PR creation without mentioning human review or repository safeguards. That omission is dangerous because it can lead to unreviewed code, insecure changes, credential misuse, or automated propagation of defects under the appearance of a recommended workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The content explicitly describes reading SMS-based 2FA codes to complete login flows, which normalizes agent access to highly sensitive message content without any warning, consent, or boundary discussion. In a use-case catalog for an autonomous agent platform, this can encourage unsafe implementations that bypass the security intent of out-of-band authentication and expose private communications.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This example directly describes reading SMS 2FA codes and using them to complete account logins, which is sensitive security-relevant behavior rather than mere harmless documentation. Because the file is a use-case catalog intended to inspire implementations, it materially lowers the barrier to building agents that intercept authentication factors and access protected accounts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The message-management example describes continuous SMS scanning and automatic calendar actions without disclosing the privacy impact of persistent access to personal communications. In an agent skill catalog, this is risky because it encourages broad collection and inference over sensitive user data without discussing consent, retention, or minimization.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The content describes always-on scanning of user text messages to extract promises and drive downstream actions, which instructs persistent collection and analysis of private communications. In the context of an autonomous agent ecosystem, this is especially sensitive because it can normalize surveillance-like behavior and create unnecessary exposure of intimate or regulated data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
The example workflow stores generated content and logs activity to local drafts and memory paths, implying session persistence of potentially sensitive drafts and prompts. Persisting user content by default can increase exposure through local compromise, over-retention, or later unintended reuse, especially in a personalized workflow touching policy, research, and community data.
- Content
Example Workflow / 示例流程:
text You (Telegram): "Write article: 'How AI Tools Are Transforming Legislative Compliance in California', 800 words, technical but accessible" OpenClaw: → Drafts article in English using Claude
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow proposes exporting and analyzing WeChat group chat histories, counting member activity, and identifying inactive individuals before presenting a privacy warning in the later security section. This can normalize surveillance of community members' communications and behavioral profiling without explicit consent, minimization, or a just-in-time warning at the point of use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The calendar workflow says OpenClaw should check board members' shared calendars and determine availability, but it does not immediately require authorization, least-privilege access, or confirmation that those calendars are intentionally shared for this purpose. That creates a privacy risk around accessing and processing others' scheduling data beyond user expectations.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 88% confidence
- Finding
The summary explicitly reveals an internal workspace skill path and states that the proposal-writing skill is already installed, which exposes environment structure and available capabilities to anyone who can read this file. That information can aid reconnaissance by helping an attacker discover internal skill names, target high-value automations, or craft social-engineering prompts that leverage known installed tools.
- Content
- Setup: 0 minutes (skill already exists in workspace!)
- Usage: Via Telegram: "Write {internal_grant} proposal: [topic]"
- ROI: 30-45 min draft vs. 4-8 hours manual = 5-10x productivity
- Location:
skills/ldrd-proposal-writer/SKILL.md
Example:
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document promotes a health assistant that combines Oura ring data with calendars, appointments, and gym schedules, all of which are sensitive personal data categories. Even though this is a catalog entry rather than executable code, presenting the use case without any privacy warning, consent guidance, or data-handling caution can normalize unsafe processing of sensitive data and lead downstream users to build privacy-invasive integrations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file-sharing section recommends uploading files to Cloudflare R2/S3 and generating presigned links for remote instances, but does not warn that files leave the local environment and are entrusted to third-party cloud storage. In a skill intended to inspire implementations, this omission can cause users to expose sensitive files or misunderstand the trust boundary and retention risks of external storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Beeper integration describes reading, sending, and archiving messages across multiple platforms from one interface, which creates a broad privacy and account-integrity risk. Without warning users that agents may gain access to personal and business conversations across services, the document encourages a high-risk integration pattern without adequate disclosure of surveillance, misuse, or accidental-message risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The catalog goes beyond neutral documentation and includes concrete operational guidance for evading platform bot-detection by using a real logged-in browser to bypass
navigator.webdriverchecks. In a use-case catalog skill, this normalizes and transfers anti-detection tradecraft to users, increasing the likelihood of policy-violating automation and abusive account activity.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown explicitly describes browser automation intended to bypass platform detection but omits any warning about platform-policy violations, account sanctions, or broader abuse risks. In a skill intended to inspire use cases, omission of safeguards makes harmful replication more likely because users are given a tactic without any risk framing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The summary elevates detection evasion to a 'key discovery,' which implicitly endorses the tactic rather than merely reporting that it exists in the community. Because summaries are high-visibility and likely to be reused in the main catalog, this increases the chance that users treat platform-evasion as a recommended production practice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Repeating the evasion guidance in the summary compounds the problem by spreading it outside the original example and stripping away even more context. Without any warning, the summary functions as a concise endorsement of bypassing platform detection, which is especially risky in a catalog skill meant to provide ideas and inspiration.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file presents itself as a curated reference, but the operational instructions tell the agent to collect new information and publish it. This mismatch can mislead users or orchestrators about the skill's real behavior, causing it to be invoked in contexts where active browsing and publication were not expected.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The skill description repeatedly frames content generation and analysis as automatically producing EN/ZH bilingual outputs, which can impose a language/locale choice by default. Under the policy, language constraints should either be optional or clearly offered as a user choice unless justified as a region-specific tool.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The summary immediately switches into bilingual presentation, including a Chinese heading, and continues this pattern throughout the file. Under the stated policy, forcing or assuming a language/locale without explicit user choice can be a natural-language policy issue unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file consistently presents all content bilingually rather than selecting language based on user preference. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy issue when no language-choice mechanism or justification is provided.
- Content
Static analysis
No suspicious patterns detected.