ClawHub
Back to skill

Security audit

Workspace Trash

Security checks for vulnerabilities and agentic risk

Overview

This trash-management skill is mostly purpose-aligned, but its restore path can be steered by a writable manifest to move files outside the advertised OpenClaw scope.

Review before installing. The skill is useful for recoverable deletes, but do not use it in shared or untrusted workspaces until restore validates manifest entries, rejects traversal, and rechecks source and destination scope immediately before moving files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/trash.sh:173
Finding

Manifest Path Traversal Allows Out-of-Scope File Relocation

Content
View full analysis
= m.length) { idx = m.findIndex(e => e.trashName === target || e.trashName.replace(/^\d+_/, "") === target); } if (idx === -1 || idx >= m.length) { console.log("❌ Not found in trash: " + target); process.exit(1); } const entry = m[idx]; const trashPath = path.join(trashDir, entry.trashName); const origDir = path.dirname(entry.originalPath); // Ensure original directory exists fs.mkdirSync(origDir, { recursive: true }); // Check if original location is occupied if (fs.existsSync(entry.originalPath)) { console.log("⚠️ Original location occupied: " + entry.originalPath); console.log(" Rename or remove it first, then retry."); process.exit(1); } // Use spawnSync to avoid shell interpretation of filenames const { spawnSync } = require("child_process"); // Try mv first, fall back to cp+rm for cross-filesystem let result = spawnSync("mv", ["--", trashPath, entry.originalPath], { stdio: "pipe" }); if (result.status !== 0) { result = spawnSync("cp", ["-a", "--", trashPath, entry.originalPath], { stdio: "pipe" }); if (result.status !== 0) { console.log("❌ Failed to restore: cp failed with status " + result.status); process.exit(1); } const rmResult = spawnSync("rm", ["-rf", "--", trashPath], { stdio: "pipe" }); if (rmResult.status ...[truncated 3151 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares executable/scripted behavior and relies on environment variables, but it does not explicitly declare a tool scope such as permissions or allowed-tools. In practice, this can cause the agent to invoke filesystem-affecting behavior without clear policy boundaries, increasing the chance of unintended file operations or bypass of least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Triggering on any file deletion request is broader than necessary and can cause the skill to activate in contexts the user did not intend, including automated cleanup flows or ambiguous prompts. Over-broad activation increases the attack surface for prompt routing mistakes and can interfere with safer, more specific deletion policies.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
# Workspace Trash

Never permanently delete workspace files. Always use trash instead of `rm`.

## Dependencies

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/trash.sh:208