Security audit

Skill Vetter Optimized

Security checks for vulnerabilities and agentic risk

Overview

This skill is a security-vetting checklist and helper script with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you want a Chinese-oriented skill-vetting workflow. Treat the Python helper as a quick triage aid, not a complete security scanner; follow the documented full review of all files before trusting any skill it checks.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/skill_checker.py:56
Finding: Incomplete File Coverage Can Produce a False-Safe Skill Assessment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/checklist.md (reported line 22)May include surrounding context.
md
## 第二阶段：代码安全审查 ### 3. 危险模式检查 (立即拒绝如果发现) - [ ] **下载并执行**: `curl | bash`, `wget | sh` - [ ] **远程代码执行**: `eval()`, `exec()` 带外部输入 - [ ] **数据外传**: 发送数据到外部服务器 - [ ] **凭证访问**: 读取SSH密钥、API密钥、密码文件

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/checklist.md (reported line 22)May include surrounding context.
md
## 第二阶段：代码安全审查 ### 3. 危险模式检查 (立即拒绝如果发现) - [ ] **下载并执行**: `curl | bash`, `wget | sh` - [ ] **远程代码执行**: `eval()`, `exec()` 带外部输入 - [ ] **数据外传**: 发送数据到外部服务器 - [ ] **凭证访问**: 读取SSH密钥、API密钥、密码文件

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/checklist.md (reported line 27)May include surrounding context.
md
- [ ] **数据外传**: 发送数据到外部服务器 - [ ] **凭证访问**: 读取SSH密钥、API密钥、密码文件 - [ ] **系统修改**: 修改系统文件、crontab、启动项 - [ ] **权限提升**: `sudo`, `chmod 777`, `setuid` - [ ] **混淆代码**: base64编码、压缩、混淆 ### 4. 权限范围评估

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill describes and embeds capabilities that imply file reading, shell execution, and network access, but it does not declare an explicit tool scope in metadata. This creates an avoidable transparency and least-privilege gap: an operator cannot easily verify whether the skill's runtime permissions are appropriately constrained before use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains prominent user-facing instructions and description text in Chinese, but it does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
• Installs packages without listing them • Network calls to IPs instead of domains • Obfuscated code (compressed, encoded, minified) • Requests elevated/sudo permissions • Accesses browser cookies/sessions • Touches credential files ─────────────────────────────────────────

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

获取并审查SKILL.md

curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

text
### 3. 使用审查清单

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all instructions and review criteria exclusively in Chinese, with no indication that the skill is intended only for a Chinese-speaking audience and no user opt-in for language selection. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/checklist.md (reported line 27)May include surrounding context.
md
- [ ] **数据外传**: 发送数据到外部服务器 - [ ] **凭证访问**: 读取SSH密钥、API密钥、密码文件 - [ ] **系统修改**: 修改系统文件、crontab、启动项 - [ ] **权限提升**: `sudo`, `chmod 777`, `setuid` - [ ] **混淆代码**: base64编码、压缩、混淆 ### 4. 权限范围评估

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill # 检查GitHub仓库信息 curl -s "https://api.github.com/repos/owner/repo" | jq '.stargazers_count, .forks_count, .updated_at' # 列出技能文件 find /path/to/skill -type f -name "*.py" -o -name "*.sh" -o -name "*.js"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill # 检查GitHub仓库信息 curl -s "https://api.github.com/repos/owner/repo" | jq '.stargazers_count, .forks_count, .updated_at' # 列出技能文件 find /path/to/skill -type f -name "*.py" -o -name "*.sh" -o -name "*.js"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/checklist.md (reported line 78)May include surrounding context.
md
python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill # 检查GitHub仓库信息 curl -s "https://api.github.com/repos/owner/repo" | jq '.stargazers_count, .forks_count, .updated_at' # 列出技能文件 find /path/to/skill -type f -name "*.py" -o -name "*.sh" -o -name "*.js"

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file content is entirely in Chinese, starting with the title at L01, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code presents its docstrings, status messages, errors, and CLI usage in Chinese only, which imposes a specific language on users without any opt-in or fallback. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a user choice or clearly justify the restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

External Script Fetching

Tool Parameter Abuse

Undeclared Tool Scope

Natural-Language Policy Violations

Sudo/Root Execution

Skill Enumeration

获取并审查SKILL.md

Natural-Language Policy Violations

Sudo/Root Execution

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis