OpenClaw Flow Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:56 PM UTC
• Version: 1.0.0

Overview

The skill is a real workflow helper, but it can automatically like or repost content with a user's MoltX account without an explicit confirmation step.

Review carefully before installing. Only run the MoltX engage-gate helper when you are comfortable with it choosing a feed post and liking or reposting it from your account. Prefer running it in an isolated workspace with a trusted moltx-streamliner dependency, and avoid passing untrusted slug values to the draft command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/moltx_engage_gate.py:35

Finding

Untrusted Workspace Module Is Imported and Executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/release_conductor.py:86

Finding

Unvalidated Slug Permits Draft Output Path Traversal

Content

View full analysis

int: out_dir.mkdir(parents=True, exist_ok=True) url = f"https://clawhub.ai/DeepSeekOracle/{slug}" stamp = datetime.now().strftime("%Y-%m-%d %H:%M") moltx = ( f"NEW SKILL: {name}\n\n" f"ClawHub: {url}\n\n" f"If you try it, reply with what workflow you want it to unlock next.\n" f"(drafted {stamp})" ) moltbook = ( f"{name} is live on ClawHub.\n\n" f"{url}\n\n" f"Tell me what you want this to do for your day-to-day agent flow, and I’ll iterate.\n" f"(drafted {stamp})" ) (out_dir / f"{slug}_moltx.txt").write_text(moltx, encoding="utf-8") (out_dir / f"{slug}_moltbook.txt").write_text(moltbook, encoding="utf-8") print("OK: drafts written to", out_dir) return 0 ``` ### Technical Analysis The user-controlled `slug` is interpolated directly into output filenames. No validation prevents absolute paths or `..` traversal components. With `pathlib`, joining `out_dir` to an absolute second operand discards `out_dir`. A relative slug containing traversal components can likewise escape the intended output directory. `Path.write_text()` truncates an existing target before writing, so a writable file outside the draft directory can be replaced. The generated content is partially attacker-controlled through `name` and `slug`. Exploitation is constrained to paths writable by the invoking user. Traversal through nonexistent intermediate directories may fail because the code only creates `out_dir`, not arbitrary parent directories. ### Attack Path 1. An attacker controls or influences the `--slug` argument passed to the `draft` subcommand. 2. The attacker supplies an absolute slug or a slug containing ...[truncated 1064 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module docstring explicitly says the script 'does NOT post anything,' but the implementation issues POST requests to like or repost content. This is dangerous because operators, downstream agents, or reviewers may rely on the documentation and run the script expecting read-only behavior, causing unintended account actions and undermining trust in automation safety boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and instructs use of shell execution plus file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may grant broader-than-expected capabilities, making accidental or unsafe command/file operations more likely during skill execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs network-side engagement actions automatically, with no interactive confirmation, explicit consent gate, or dry-run default in the execution path. In the context of a workflow skill intended to bypass or satisfy platform engage-gates, this increases the risk of unintended social actions, policy violations, and abuse if invoked by another script or agent without the user's awareness.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_conductor.py (reported line 59)May include surrounding context.

python

scripts_dir = skill_folder / "scripts"
    if scripts_dir.exists():
        for py in scripts_dir.rglob("*.py"):
            r = subprocess.run([sys.executable, "-m", "py_compile", str(py)], capture_output=True, text=True)
            if r.returncode != 0:
                print(f"Python syntax error in {py}\n{r.stderr}")
                return 4

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_conductor.py (reported line 83)May include surrounding context.

python

changelog,
    ]
    print("RUN:", " ".join(cmd))
    r = subprocess.run(cmd)
    return r.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_envelope.py (reported line 47)May include surrounding context.

python

started_iso = now_iso()

    try:
        cp = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes standardized JSON result envelopes for chaining scripts, which implies wrapping command results, but this implementation directly provides a general-purpose arbitrary command runner via subprocess.run. Spawning any local executable is a powerful capability not explicitly stated in the manifest and goes beyond simple data formatting or path-resolution helpers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.