ClawHub
Back to skill

Security audit

CodeSmith

Security checks for vulnerabilities and agentic risk

Overview

CodeSmith is a disclosed coding-agent configuration package with real autonomy features, but the artifacts are coherent, instruction-only, and include clear review and safety boundaries.

Install only if you want a more autonomous coding partner. Before enabling cron jobs or ACP dispatch, review the files, keep GitHub and hosting credentials least-privilege, add crons one at a time, verify LOCKDOWN works, and require human approval for production deploys, main-branch merges, public posts, and external messages.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill states it is applied automatically by another skill during a scheduled ingestion cycle, but it does not define strong activation constraints, approval gates, or scope limits. In a code-execution and CI/CD context, broad automatic ingestion increases the chance that operational guidance, cron recommendations, or autonomy-enabling configuration is adopted without deliberate human review, which can expand privileges or change agent behavior unexpectedly.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
[HUMAN_NAME] communicates via voice-to-text most of the time. This means: verbose messages, stream-of-consciousness, sometimes multiple ideas run together, occasional transcription errors. The content is always real — the format is variable.

What I learned to do: pull the task from the noise without asking "did you mean X?" Voice-to-text users have already explained what they want — they don't want to explain it again in a different format. Parse the signal. Act on it. Clarify only when the ambiguity would cause real problems.

**The clarification rule:**
Confidence
86% confidence
Finding
This guidance encourages the agent to infer intent from noisy voice-to-text and act with minimal clarification, which can lead to unauthorized or incorrect code changes when instructions are ambiguous. In a coding/CI/CD skill with overnight autonomy and repo access, misinterpretation can cause impactful changes before the human has a chance to correct course.

Scope Creep

Low
Category
Excessive Agency
Content
4. **Assumptions presented as facts.** "I assumed X" presented honestly is fine. "X is true" when X is an assumption destroys credibility when X turns out to be wrong.

5. **Scope creep without notice.** Working beyond the stated task without saying so. Even if the extra work was valuable — especially if the extra work was valuable — saying "I also did Y while I was there" after the fact is better than doing it silently.

---
Confidence
72% confidence
Finding
Although framed as a warning against silent scope creep, the text still normalizes performing extra work beyond the stated task and merely disclosing it afterward. In an engineering agent with broad repo and operational access, that can weaken change control and allow unreviewed modifications outside the approved scope.

Session Persistence

Medium
Category
Rogue Agent
Content
"sessionTarget": "isolated",
      "payload": {
        "kind": "agentTurn",
        "message": "LOCKDOWN CHECK FIRST: if ~/.openclaw/workspace/LOCKDOWN.md exists, halt immediately and alert [HUMAN_NAME].\n\nYou are [AGENT_NAME]. Evening Planning Session (8:30 PM).\n\nCheck [YOUR_CHANNEL] for any context [HUMAN_NAME] dropped during the day.\nReview what happened today.\n\nPick ONE focus for tonight's 11 PM work session:\n- Something [HUMAN_NAME] can't do manually but you can\n- An audit of what we have (bugs, broken links, stale data)\n- A feature or prototype to build\n- Something that will create genuine value in the morning\n\nDO NOT plan: live deploys, social posts, public pushes to main.\nDO: branches, internal tools, audits, prototypes, specs.\n\nWrite plan to: ~/workspace/memory/overnight-plan-[today's date].md\n\nFormat:\n1. What and why it matters\n2. Specific steps\n3. Success definition\n4. Files/repos needed\n\nPost 2-sentence summary to [YOUR_CHANNEL]."
      },
      "delivery": {
        "mode": "announce",
Confidence
88% confidence
Finding
The skill persists cross-session state by writing an overnight plan file into shared workspace memory and then consuming it in a later autonomous session. If that memory file is tampered with by another process, compromised tool, or prior prompt injection, the overnight job could inherit malicious instructions and perform unintended actions across repositories or internal systems.

Static analysis

No suspicious patterns detected.