ClawHub
Back to skill

Security audit

safety-kb-query.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only helper for querying a local safety-regulation SQLite knowledge base, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you intend to let the agent query the local safety-review SQLite knowledge base. Keep KB_PATH unset or set only to the intended knowledge.db file, and avoid using the schema or info commands on databases that may contain private or unrelated data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to use environment-dependent resources such as python/python3 and KB_PATH, but it does not declare an explicit tool or permission scope. That creates an implicit execution boundary where an agent may invoke local interpreters or trust environment variables without a clear allowlist, increasing the chance of unintended local access or use of attacker-influenced configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description explicitly frames usage and trigger phrases in Chinese, which can amount to a language policy constraint if users are not given an opt-in or alternative language path. The file does not state that the skill is China-specific or otherwise justify limiting activation language.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
## Overview

This skill provides **unified, schema-adaptive query access** to the `safety-review` knowledge base (SQLite database). It eliminates the need to manually write connection scripts, guess field names, or handle encoding issues every time.

**Database location**: `~/.openclaw-autoclaw/skills/safety-review/db/knowledge.db`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation condition 'Any task involving the safety-review SQLite database' is overly broad and can cause the skill to trigger in situations beyond the user's intent. Overbroad triggering raises the risk of unnecessary access to local data, accidental disclosure, or execution of database-query workflows when a narrower, user-confirmed action would be safer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger section only lists Chinese phrases, which may force a specific language for activation. Because no alternative language options or locale justification are provided, this appears to violate the language-choice policy described in the audit criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The schema subcommand enumerates all SQLite tables and selected column layouts, which goes beyond the advertised need of querying regulations and clauses. In an agent setting, schema disclosure can help a user or downstream prompt discover undocumented tables, sensitive metadata, or expand follow-on data extraction beyond the intended knowledge-base scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The database path is taken from the KB_PATH environment variable with no validation that it points to the intended knowledge-base file. In an agent/runtime environment, this broadens the tool from a fixed KB query utility into a general local SQLite reader, enabling access to other local databases the process can read and potentially exposing unrelated sensitive data.

Content

No source excerpt is available for this finding.