T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup_agent.sh:84- Finding
Predictable Matrix Account Passwords
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-manager
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for OpenClaw agent setup, but it handles Matrix credentials in ways that could expose or weaken them.
Review before installing. Use only against a trusted local Matrix server unless HTTPS is enforced, rotate any accounts created with the predictable password pattern, avoid logging access-token output, and restrict permissions on ~/.openclaw/openclaw.json because it stores bearer tokens.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/matrix_register.sh:4- Finding
Matrix Credentials and Access Tokens May Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac ``` - Rotate passwords and access tokens that may previously have traversed untrusted HTTP connections. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_agent.sh:110- Finding
Matrix Access Token Exposed through Process Command-Line Arguments
- Content
View full analysis
5 ``` ### Technical Analysis The Matrix bearer token is passed as a command-line argument to `config_manager.py`. Command-line argument vectors can be exposed through process inspection facilities and may be captured by process accounting, audit frameworks, endpoint monitoring systems, debugging tools, or operational telemetry. The exposure window is limited to the lifetime of the Python process, but the token is a reusable authentication secret. Quoting the shell variable prevents shell expansion but does not hide it from process metadata. ### Attack Path 1. The setup script successfully obtains a Matrix access token. 2. It launches `config_manager.py` with that token in the process argument vector. 3. A local user or monitoring component with permission to inspect process metadata observes the running command. 4. The observer extracts the token from the argument list. 5. The token is used against the Matrix API to impersonate the affected account until the token is revoked or expires. ### Impact Assessment Exploitation provides the privileges of the affected Matrix access token. This may include reading account-accessible rooms or messages, sending messages as the agent account, and invoking any workflows that trust that account. Exploitation requires local process visibility or access to telemetry that records process arguments. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config_manager.py:31- Finding
Secret-Bearing Configuration File Is Written without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch is more serious because the skill behavior includes generating/displaying credentials, persisting Matrix access tokens, and initializing/copying workspace files without clearly foregrounding those sensitive actions in the top-level declaration. Hidden credential handling and filesystem side effects materially increase risk of secret exposure and unintended local changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch is more serious because the skill behavior includes generating/displaying credentials, persisting Matrix access tokens, and initializing/copying workspace files without clearly foregrounding those sensitive actions in the top-level declaration. Hidden credential handling and filesystem side effects materially increase risk of secret exposure and unintended local changes.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 81% confidence
- Finding
The skill context explicitly involves obtaining and handling Matrix access tokens, which are high-value credentials. In this context, credential access is expected functionally, but it remains security-sensitive because exposed tokens can allow account takeover or unauthorized messaging/API actions if leaked via logs, console output, or insecure storage.
- Content
3. matrix_register.sh - Matrix 账号注册
用于在 Matrix 服务器上注册新账号并获取 Access Token。
用法:
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh fi } # 2. 获取 Access Token get_token() { local user="$1" local pass="$2"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh fi } # 2. 获取 Access Token get_token() { local user="$1" local pass="$2"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script prints the Matrix access token directly to stdout, which can leak credentials into terminal scrollback, shell history wrappers, CI logs, orchestration logs, or any parent process capturing output. In an agent-management context, this is especially dangerous because the token enables authenticated access to the Matrix account and may be consumed by automation in ways that broaden exposure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents shell execution plus local file read/write behavior, but it does not declare any explicit tool scope or permission boundary. In an agent ecosystem, this weakens reviewability and allows a caller to invoke a skill with broader operational capability than users may reasonably expect, increasing the chance of unsafe configuration changes or command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explains account registration and config updates but fails to warn that Matrix access tokens will be stored in the local configuration file. Storing bearer tokens on disk without clear notice can lead to accidental exposure through backups, source control, overbroad file permissions, or local compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script accepts Matrix access tokens on the command line and persists them in a JSON config file, which creates credential exposure risks. Command-line arguments may be visible via shell history, process listings, logs, or terminal recording, and the saved file is written without enforcing restrictive permissions, increasing the chance of token theft and account compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Comments and runtime messages such as the usage string and status output are written only in Chinese, with no indication that the skill is region-specific or that users can choose another language. This can violate language/locale policy when a skill forces a single language without opt-in or justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The script transmits username and password to a homeserver URL that defaults to plain HTTP (http://localhost:8008), meaning credentials may be exposed if the service is not strictly local or if traffic is redirected, proxied, or container-network accessible. Because this skill manages agent lifecycle and account provisioning, credential transmission is expected, but the insecure default transport makes the operation materially riskier.
- Content
sh echo "--- 正在尝试注册: $user ---" # 直接使用你提供的 v3 接口和 payload local resp=$(curl -s -X POST "${HOMESERVER_URL}/_matrix/client/v3/register" \ -H "Content-Type: application/json" \ -d "{ \"username\": \"$user\",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell script performs a filesystem write by recursively copying a template workspace into a user-specific directory. Although the script describes its high-level setup flow, there is no user-facing disclosure immediately before this write operation and no confirmation prompt for an action that can overwrite or modify local files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Natural-language policy requires avoiding forced language or locale constraints unless the user opts in or the restriction is documented as necessary. This skill presents all operational instructions in Chinese only, which can exclude users who have not selected that language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
User-facing strings, help text, and module description are all in Chinese, which effectively forces a specific language for interaction. The file does not offer an opt-in language choice or explain that the tool is intentionally limited to a Chinese-speaking audience.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage text says
bindings remove <agentId> <accountId>and error messages for bindings mentionaccount userId, while account removal help saysaccounts remove <name>. In code,remove_bindingmatches againstmatch.accountIdandremove_matrix_accountsearches byinfo.name, so the documentation and prompts mix up userId, accountId, and name in a way that can mislead operators about what identifier the command actually uses.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Natural-language strings in comments and help/output messages consistently force a specific language locale. Under the stated policy, this is a language/locale constraint without an explicit user opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.