OpenClaw Flow Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:56 PM UTC
• Version: 1.0.0

Overview

The skill is a real workflow helper, but it can automatically like or repost content with a user's MoltX account without an explicit confirmation step.

Review carefully before installing. Only run the MoltX engage-gate helper when you are comfortable with it choosing a feed post and liking or reposting it from your account. Prefer running it in an isolated workspace with a trusted moltx-streamliner dependency, and avoid passing untrusted slug values to the draft command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/moltx_engage_gate.py:35
• Finding: Untrusted Workspace Module Is Imported and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/moltx_engage_gate.py`, lines 35-42 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```python # Import MoltX client from local workspace skill ws = Path(__file__).resolve().parents[4] client_dir = ws / "skills" / "moltx-streamliner" / "scripts" if not client_dir.exists(): print(json.dumps({"ok": False, "error": "moltx-streamliner not found", "expected": str(client_dir)}, indent=2)) return 2 sys.path.insert(0, str(client_dir)) from moltx_client import session, API_BASE # type: ignore s = session() ``` ### Technical Analysis The script constructs a path to a sibling workspace Skill, prepends that directory to `sys.path`, and imports `moltx_client` without verifying the file's identity, integrity, ownership, or version. Importing a Python module executes its top-level code immediately. The imported module also supplies both `session` and `API_BASE`. Consequently, a modified or substituted dependency can run arbitrary Python code and can control the destination of subsequent authenticated HTTP requests. Exploitation requires the attacker to be able to create or modify files under the expected `skills/moltx-streamliner/scripts` directory. The issue does not independently grant an external attacker access to that directory, but it turns such local or supply-chain modification into code execution when the documented helper is invoked. ### Attack Path 1. An attacker gains write access to the workspace dependency directory or supplies a compromised `moltx-streamliner` Skill. 2. The attacker creates or modifies `skills/moltx-streamliner/scripts/moltx_client.py`. 3. A user runs `python scripts/moltx_engage_gate.py --mode minimal`. 4. The script places the dependency directory first in `sys.path`. 5. Python imports the attacker's module and executes its top-level code with the user's privileges. 6. The malicio ...[truncated 643 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace dynamic sibling-Skill loading with a packaged, reviewed, and version-pinned dependency. - If workspace loading is required, resolve the module path and verify that it is beneath an approved dependency directory. - Verify the expected module using a trusted cryptographic digest or signed manifest before importing it. - Validate that the dependency directory and module are not writable by untrusted users. - Restrict `API_BASE` to an explicit allowlist of HTTPS origins before sending requests. - Avoid inserting mutable workspace directories at the beginning of `sys.path`; load a verified module from a specific file when unavoidable. - Run the helper with minimal filesystem and credential access so that a compromised dependency has a reduced impact. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/release_conductor.py:86
• Finding: Unvalidated Slug Permits Draft Output Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/release_conductor.py`, lines 86-108 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```python def cmd_draft(slug: str, name: str, out_dir: Path) -> int: out_dir.mkdir(parents=True, exist_ok=True) url = f"https://clawhub.ai/DeepSeekOracle/{slug}" stamp = datetime.now().strftime("%Y-%m-%d %H:%M") moltx = ( f"NEW SKILL: {name}\n\n" f"ClawHub: {url}\n\n" f"If you try it, reply with what workflow you want it to unlock next.\n" f"(drafted {stamp})" ) moltbook = ( f"{name} is live on ClawHub.\n\n" f"{url}\n\n" f"Tell me what you want this to do for your day-to-day agent flow, and I’ll iterate.\n" f"(drafted {stamp})" ) (out_dir / f"{slug}_moltx.txt").write_text(moltx, encoding="utf-8") (out_dir / f"{slug}_moltbook.txt").write_text(moltbook, encoding="utf-8") print("OK: drafts written to", out_dir) return 0 ``` ### Technical Analysis The user-controlled `slug` is interpolated directly into output filenames. No validation prevents absolute paths or `..` traversal components. With `pathlib`, joining `out_dir` to an absolute second operand discards `out_dir`. A relative slug containing traversal components can likewise escape the intended output directory. `Path.write_text()` truncates an existing target before writing, so a writable file outside the draft directory can be replaced. The generated content is partially attacker-controlled through `name` and `slug`. Exploitation is constrained to paths writable by the invoking user. Traversal through nonexistent intermediate directories may fail because the code only creates `out_dir`, not arbitrary parent directories. ### Attack Path 1. An attacker controls or influences the `--slug` argument passed to the `draft` subcommand. 2. The attacker supplies an absolute slug or a slug containing ...[truncated 1064 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate `slug` against a strict allowlist, such as `^[A-Za-z0-9][A-Za-z0-9_-]*$`. - Reject slugs containing path separators, drive prefixes, absolute paths, `.` components, or `..` components. - Resolve each candidate output path and verify that it remains beneath the resolved output directory before writing. - Use `Path.relative_to()` or `Path.is_relative_to()` for containment validation. - Refuse to overwrite existing files by default, for example by opening them in exclusive creation mode (`"x"`), unless the operator explicitly requests replacement. - Consider rejecting symbolic-link output targets or opening files with platform-appropriate no-follow protections where local races are within the threat model. - Apply reasonable length limits to `slug` and `name` to prevent filesystem errors and oversized draft output. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module docstring explicitly says the script 'does NOT post anything,' but the implementation issues POST requests to like or repost content. This is dangerous because operators, downstream agents, or reviewers may rely on the documentation and run the script expecting read-only behavior, causing unintended account actions and undermining trust in automation safety boundaries.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and instructs use of shell execution plus file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may grant broader-than-expected capabilities, making accidental or unsafe command/file operations more likely during skill execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script performs network-side engagement actions automatically, with no interactive confirmation, explicit consent gate, or dry-run default in the execution path. In the context of a workflow skill intended to bypass or satisfy platform engage-gates, this increases the risk of unintended social actions, policy violations, and abuse if invoked by another script or agent without the user's awareness.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

scripts_dir = skill_folder / "scripts"
    if scripts_dir.exists():
        for py in scripts_dir.rglob("*.py"):
            r = subprocess.run([sys.executable, "-m", "py_compile", str(py)], capture_output=True, text=True)
            if r.returncode != 0:
                print(f"Python syntax error in {py}\n{r.stderr}")
                return 4

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

changelog,
    ]
    print("RUN:", " ".join(cmd))
    r = subprocess.run(cmd)
    return r.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

started_iso = now_iso()

    try:
        cp = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The manifest describes standardized JSON result envelopes for chaining scripts, which implies wrapping command results, but this implementation directly provides a general-purpose arbitrary command runner via subprocess.run. Spawning any local executable is a powerful capability not explicitly stated in the manifest and goes beyond simple data formatting or path-resolution helpers.

Static analysis

No suspicious patterns detected.