Local Task Runner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:56 PM UTC
• Version: 1.0.0

Overview

This skill openly runs local Node.js code, but it is framed as safe while giving that code broad access to the host system without real isolation.

Install this only if you intentionally want the agent to run trusted JavaScript with the same local access as the skill process. Do not use it for code derived from untrusted webpages, prompts, files, or users unless it is placed behind a real sandbox such as a disposable container with limited files, scrubbed environment variables, and restricted networking. Pin dependencies before deployment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:55

Finding

Unrestricted Host Code Execution Without Isolation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:14

Finding

Timeout Does Not Reliably Terminate Spawned Process Trees

Content

View full analysis

{ const child = exec(command, { timeout: timeout, maxBuffer: 1024 * 1024 * 5 }, (error, stdout, stderr) => { if (error) { resolve({ ``` ### Technical Analysis The runner uses `child_process.exec()`, which invokes the command through a shell. The `timeout` option can terminate the immediate child process, but it is not a security boundary and does not guarantee termination of every descendant process created by submitted JavaScript. Because the submitted code has unrestricted access to Node.js process APIs, it can create detached or otherwise independently running descendants. Such a descendant may survive after the direct task process exits or is terminated by the timeout. Although the currently constructed command quotes an internally generated file path and no direct command-injection vector was identified in that path, shell invocation is unnecessary and increases execution complexity. ### Attack Path 1. Attacker-controlled JavaScript is submitted through `--code`. 2. The JavaScript creates a detached child process or another independently running descendant. 3. The direct Node.js task exits or exceeds its configured timeout. 4. The runner terminates or observes termination of only the direct task process. 5. The descendant remains active and continues consuming resources, accessing files, or communicating over the network. ### Impact Assessment A surviving process can continue operating outside the runner's advertised task duration. Depending on the runner account's permissions, this can result in: - Continued access to local files and inherited credentials. - Background network activity. - Resource exhaustion throu ...[truncated 355 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:70

Finding

Temporary Task Source Is Not Cleaned Up on All Failure Paths

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code takes user-supplied JavaScript, writes it to disk, and executes it with Node.js, which grants arbitrary code execution on the local system. An attacker can use this to read or modify files, access environment secrets, run network requests, install persistence, or invoke additional system commands through Node APIs, making the host fully compromiseable within the process's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly states it can execute Node.js snippets or full scripts locally on the host machine, but it does not prominently warn users that this enables arbitrary code execution on the local system. In an agent ecosystem, that omission is security-relevant because users or downstream components may invoke it without understanding that it has direct host execution capability, increasing the risk of accidental misuse or privilege abuse.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a caret range (^9.0.0), which permits automatic installation of newer 9.x releases and prevents reproducible builds. This increases supply-chain risk because different environments may resolve different versions, including a newly introduced vulnerable or compromised release.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"author": "OpenClaw",
  "license": "MIT",
  "dependencies": {
    "uuid": "^9.0.0"
  }
}

Unverifiable Dependency: uuid has 1 known advisory(ies) (CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The manifest references uuid without an exact pinned version, while an advisory exists for some releases. Because the allowed range may resolve to an affected version and the actual installed version is unverifiable from this file alone, the package may include a known vulnerable release depending on when and how it is installed.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:15