T08 · Insecure Dependencies
Warning
- Location
package.json:12- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Agentic-Liquid-Neural-Network-Wireless-Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed network-management tool, but it needs Review because it can monitor nearby movement and automatically change network settings with broad triggers and imperfect data-flow disclosure.
Install only if you are comfortable granting a local agent Wi-Fi scan access, shell execution, persistent RF history storage, and possible admin-level network changes. Prefer quick scan or read-only mode, avoid sentinel/presence sensing around people who have not consented, review each remediation command before allowing it, and use a pinned virtual environment for dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:173- Finding
Cleartext External Speed Test Conflicts with Local-Only Privacy Claims
- Content
View full analysis
/dev/null ``` The Skill simultaneously makes an absolute local-only claim: ```text - All processing is local — no data leaves the device ``` The permissions documentation similarly states: ```text All processing is local. No data is transmitted to any server, cloud service, or external API. ``` ### Technical Analysis The throughput test contacts `speedtest.tele2.net` over unencrypted HTTP. Although the downloaded file is discarded and not executed, the request necessarily transmits network traffic and exposes metadata such as the source public IP address, timing, HTTP headers, and repeated monitoring activity to the destination and intervening network operators. Because HTTP provides neither transport confidentiality nor server authentication, an on-path attacker can intercept or replace the response. The downloaded content is not executed, so this does not constitute remote payload retrieval and execution. However, an attacker can manipulate the transfer rate or availability observed by the Skill. This measurement is used within a workflow that scores network quality and may automatically change DNS settings, switch Wi-Fi networks, renew DHCP, or restart the wireless adapter. A single unauthenticated measurement should not influence privileged or connectivity-disrupting actions without corroboration. The request also contradicts the documented claims that no data leaves the device and th ...[truncated 1249 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (70)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README prominently advertises sensing human movement through walls via RSSI variance, but the warning and consent language is not equally prominent where the capability is introduced. This is privacy-sensitive functionality that could normalize covert monitoring of nearby people, making accidental or inappropriate use materially more dangerous in this skill context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The document advertises sophisticated sensing, navigation, presence detection, and autonomous remediation that are not substantiated by implementation. Security-wise, this is dangerous because users may grant elevated permissions, background monitoring, or trust decisions based on capabilities that do not actually exist or cannot be validated.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The use of chained shell commands with privileged execution increases the chance that a partial failure still leads to additional state-changing commands or that future variable interpolation becomes command-injection prone. In a networking tool, such chains can cause compounded system changes and make error handling unsafe.
- Content
md | Condition | Action | Command (macOS) | Command (Linux) | Command (Windows) | |-----------|--------|-----------------|-----------------|-------------------| | DNS >2x slower than 1.1.1.1 | Switch DNS | `networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1` | `resolvectl dns $IF 1.1.1.1 1.0.0.1` | `Set-DnsClientServerAddress -InterfaceAlias Wi-Fi -ServerAddresses 1.1.1.1,1.0.0.1` | | Stale DNS responses | Flush cache | `sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder` | `sudo systemd-resolve --flush-caches` | `Clear-DnsClientCache` | | DHCP lease expiring | Renew | `sudo ipconfig set $IF DHCP` | `sudo dhclient -r $IF && sudo dhclient $IF` | `ipconfig /renew` | | SAC-LTC confidence >0.7 for different network | Switch network | `networksetup -setairportnetwork $IF SSID [password]` | `nmcli dev wifi connect SSID` | `netsh wlan connect name=SSID` | | Packet loss >10% for 3+ cycles | Restart adapter | `networksetup -setairportpower $IF off && sleep 2 && networksetup -setairportpower $IF on` | `sudo nmcli radio wifi off && sleep 2 && sudo nmcli radio wifi on` | `Disable-NetAdapter -Name Wi-Fi -Confirm:$false; Start-Sleep 2; Enable-NetAdapter -Name Wi-Fi -Confirm:$false` |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The DHCP renew sequence and related chained operations create multiple privileged state transitions in one line, making behavior harder to validate and recover from. If embedded in automation, this pattern magnifies disruption and complicates auditing of what actually executed.
- Content
md |-----------|--------|-----------------|-----------------|-------------------| | DNS >2x slower than 1.1.1.1 | Switch DNS | `networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1` | `resolvectl dns $IF 1.1.1.1 1.0.0.1` | `Set-DnsClientServerAddress -InterfaceAlias Wi-Fi -ServerAddresses 1.1.1.1,1.0.0.1` | | Stale DNS responses | Flush cache | `sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder` | `sudo systemd-resolve --flush-caches` | `Clear-DnsClientCache` | | DHCP lease expiring | Renew | `sudo ipconfig set $IF DHCP` | `sudo dhclient -r $IF && sudo dhclient $IF` | `ipconfig /renew` | | SAC-LTC confidence >0.7 for different network | Switch network | `networksetup -setairportnetwork $IF SSID [password]` | `nmcli dev wifi connect SSID` | `netsh wlan connect name=SSID` | | Packet loss >10% for 3+ cycles | Restart adapter | `networksetup -setairportpower $IF off && sleep 2 && networksetup -setairportpower $IF on` | `sudo nmcli radio wifi off && sleep 2 && sudo nmcli radio wifi on` | `Disable-NetAdapter -Name Wi-Fi -Confirm:$false; Start-Sleep 2; Enable-NetAdapter -Name Wi-Fi -Confirm:$false` |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 91% confidence
- Finding
The adapter power-cycle sequence chains disable, sleep, and re-enable actions, which is brittle and hazardous in unattended contexts. Combined with privilege use and periodic triggering, it can cause repeated denial of network access and unpredictable host behavior.
- Content
md | Stale DNS responses | Flush cache | `sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder` | `sudo systemd-resolve --flush-caches` | `Clear-DnsClientCache` | | DHCP lease expiring | Renew | `sudo ipconfig set $IF DHCP` | `sudo dhclient -r $IF && sudo dhclient $IF` | `ipconfig /renew` | | SAC-LTC confidence >0.7 for different network | Switch network | `networksetup -setairportnetwork $IF SSID [password]` | `nmcli dev wifi connect SSID` | `netsh wlan connect name=SSID` | | Packet loss >10% for 3+ cycles | Restart adapter | `networksetup -setairportpower $IF off && sleep 2 && networksetup -setairportpower $IF on` | `sudo nmcli radio wifi off && sleep 2 && sudo nmcli radio wifi on` | `Disable-NetAdapter -Name Wi-Fi -Confirm:$false; Start-Sleep 2; Enable-NetAdapter -Name Wi-Fi -Confirm:$false` | After each auto-action, log to `~/.net-intel/actions.log` and verify the action improved the connection by re-scanning after 10 seconds.
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
macOS:
bash sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponderLinux:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
macOS:
bash sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponderLinux:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
macOS:
bash sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponderLinux:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Linux:
bash sudo systemd-resolve --flush-caches 2>/dev/null || sudo resolvectl flush-cachesWindows (PowerShell):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The changelog describes presence detection, live spatial awareness, movement classification, and directional sensing without any privacy notice, consent requirement, or limitation statement. Because this skill is explicitly positioned for network and nearby-person/environment intelligence, omission of privacy warnings makes the capability more dangerous by normalizing surveillance-like behavior that could be used to infer occupancy or movement of nearby individuals.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The changelog advertises autonomous monitoring and auto-optimization behaviors such as scheduled background execution, DNS changes, DHCP renewal, network switching, and adapter restart, but it does not warn that these actions can alter host networking or disrupt connectivity. In an agent skill context, documenting these capabilities without explicit user-consent and safety language increases the risk that operators enable invasive or system-affecting behaviors without understanding the consequences.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - Python 3.8+ compatible - No external dependencies beyond PyTorch and NumPy for the core agent - OS commands must work without elevated privileges for read operations - All admin/sudo commands must be documented in `docs/PERMISSIONS_AND_CONTROLS.md` - Plain English output — avoid jargon in user-facing messages ## Testing
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - Python 3.8+ compatible - No external dependencies beyond PyTorch and NumPy for the core agent - OS commands must work without elevated privileges for read operations - All admin/sudo commands must be documented in `docs/PERMISSIONS_AND_CONTROLS.md` - Plain English output — avoid jargon in user-facing messages ## Testing
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
cp SKILL.md /path/to/your/project/SKILL.md
Option B: Copy to global skills directory
mkdir -p ~/.claude/skills/net-intel cp SKILL.md ~/.claude/skills/net-intel/SKILL.md cp sac_ltc_agent.py ~/.claude/skills/net-intel/sac_ltc_agent.py
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The instructions install the skill into a persistent global directory, which makes the capability available across future sessions rather than only the current project. Persistence is not inherently malicious, but in this context it increases risk because the skill includes broad invocation patterns and privacy-sensitive sensing features that may remain enabled or discoverable longer than the user expects.
- Content
cp SKILL.md /path/to/your/project/SKILL.md
Option B: Copy to global skills directory
mkdir -p ~/.claude/skills/net-intel cp SKILL.md ~/.claude/skills/net-intel/SKILL.md cp sac_ltc_agent.py ~/.claude/skills/net-intel/sac_ltc_agent.py
text
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Option B: Copy to global skills directory
mkdir -p ~/.claude/skills/net-intel cp SKILL.md ~/.claude/skills/net-intel/SKILL.md cp sac_ltc_agent.py ~/.claude/skills/net-intel/sac_ltc_agent.py
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger examples are broad enough that an agent may invoke the skill during ordinary troubleshooting conversations, even when the user did not intend to activate wireless scanning, optimization, or presence-sensing features. In this skill, unintended invocation is more sensitive than usual because the tool can collect local RF environment data and make system/network changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The OpenClaw trigger phrases include generic terms like 'check network', 'wifi slow', and especially 'someone nearby', which can cause accidental routing to this skill from ordinary conversation. Because the skill can perform monitoring and infer nearby human movement, loose routing increases the chance of privacy-invasive or unnecessary execution.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents file writes to ~/.net-intel/ and persistent logging, but the manifest does not declare tool scope or permissions boundaries. This makes the effective capability broader and less auditable, increasing the chance that a host agent exposes file-write behavior without explicit user understanding.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The "Use when" list includes generic phrases like "network issues," "internet problems," "check connection," and "fix network," which are common conversational requests and not narrowly scoped triggers. The description does not provide exclusion conditions or negative examples to clarify when this skill should or should not activate.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Requesting optional sudo/admin access is not inherently malicious, but it expands the blast radius of any mistakes or downstream command misuse. In this skill, privileged access is tied to network reconfiguration and restart actions, making later automation more risky.
- Content
md Python 3.8+ with PyTorch and NumPy — for SAC-LTC inference OPTIONAL: Admin/sudo access — for DNS optimization, DHCP renewal, adapter restart RESOURCE USAGE: CPU: < 2% (tiny model, ~15K parameters)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill explicitly asks for file write access to store weights, history, and spatial calibration under a persistent home-directory path. Persistence itself is legitimate here, but in context it stores sensitive environmental and behavior-derived data, increasing privacy and tampering risk.
- Content
md 3. **Terminal execution** — to run OS network commands 4. **Python execution** — for SAC-LTC inference engine 5. **Admin/sudo** (optional) — only for auto-optimization actions 6. **File write to ~/.net-intel/** — for history, weights, spatial calibration 7. **Background execution** — for monitor and sentinel modes ### From Access Points
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims to be client-only and passive, but later instructs active network reconfiguration such as DNS changes, DHCP renewal, adapter restart, and network switching. That mismatch can mislead users into consenting to a passive diagnostic tool while actually authorizing configuration changes that alter system networking.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
Creating a persistent application directory is common, but here it silently establishes a storage location for monitoring artifacts and model files without explicit lifecycle controls. That can become a foothold for long-lived collection of sensitive telemetry.
- Content
md # If missing, install: # pip3 install torch numpy # Create data directory mkdir -p ~/.net-intel # Initialize or check model weights
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The documented actions include commands that modify DNS settings, switch networks, and restart adapters, some under elevated privileges. If executed automatically or with unsanitized variables, these operations can break connectivity, redirect traffic through attacker-controlled DNS, or disrupt system networking.
- Content
md | Condition | Action | Command (macOS) | Command (Linux) | Command (Windows) | |-----------|--------|-----------------|-----------------|-------------------| | DNS >2x slower than 1.1.1.1 | Switch DNS | `networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1` | `resolvectl dns $IF 1.1.1.1 1.0.0.1` | `Set-DnsClientServerAddress -InterfaceAlias Wi-Fi -ServerAddresses 1.1.1.1,1.0.0.1` | | Stale DNS responses | Flush cache | `sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder` | `sudo systemd-resolve --flush-caches` | `Clear-DnsClientCache` | | DHCP lease expiring | Renew | `sudo ipconfig set $IF DHCP` | `sudo dhclient -r $IF && sudo dhclient $IF` | `ipconfig /renew` | | SAC-LTC confidence >0.7 for different network | Switch network | `networksetup -setairportnetwork $IF SSID [password]` | `nmcli dev wifi connect SSID` | `netsh wlan connect name=SSID` | | Packet loss >10% for 3+ cycles | Restart adapter | `networksetup -setairportpower $IF off && sleep 2 && networksetup -setairportpower $IF on` | `sudo nmcli radio wifi off && sleep 2 && sudo nmcli radio wifi on` | `Disable-NetAdapter -Name Wi-Fi -Confirm:$false; Start-Sleep 2; Enable-NetAdapter -Name Wi-Fi -Confirm:$false` |