ClawHub
Back to skill

Security audit

Git Federation Searcher

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its search purpose, but it contains exploitable command execution and under-scoped network and credential handling risks that need review before installation.

Do not install this skill in a shared, bot-accessible, or privileged environment unless the shell=True fallback is removed, Telegram admin checks are added, custom instance URLs are restricted, and API tokens are moved out of plaintext config and URL parameters. There is no clear evidence of intentional exfiltration or destructive behavior, but the current implementation exposes high-impact abuse paths.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
git_federation_searcher.py:258
Finding

Shell Command Injection Through the SearXNG Fallback Query

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
git_federation_searcher.py:108
Finding

Unrestricted Custom Instance URLs Enable Server-Side Request Forgery

Content
View full analysis
bool: """Add a new Git instance""" # Remove trailing slash url = url.rstrip('/') # Detect type from URL if not specified if inst_type == "auto": inst_type = self._detect_type(url) instance = GitInstance( name=name, url=url, type=inst_type, api_token=api_token ) # Test connection if self._test_instance(instance): self.instances[name.lower().replace(" ", "_")] = instance self.save_config() return True return False ``` The URL is subsequently requested by `curl`: ```python def _test_instance(self, instance: GitInstance) -> bool: """Test if instance is reachable""" try: result = subprocess.run( ["curl", "-s", "-m", "5", "-o", "/dev/null", "-w", "%{http_code}", f"{instance.url}/api/v1/version"], capture_output=True, text=True ) return result.stdout.strip() in ["200", "401", "403"] except: return False ``` The Telegram command exposes this operation without any visible administrator or user-authorization check: ```python name, url, inst_type = context.args[0], context.args[1], context.args[2] processing = await update.message.reply_text(f"➕ Teste {name}...") try: if self.searcher.add_instance(name, url, inst_type): await processing.edit_text(f"✅ Instanz '{name}' hinzugefügt!\n\nURL: {url}\nTyp: {inst_type}") else: ...[truncated 2431 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
git_federation_searcher.py:96
Finding

Git API Tokens Are Stored in Plaintext and Transmitted in URL Query Strings

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The tool invocation at this line directly incorporates attacker-controlled query content into a shell command, allowing parameter abuse to become full command injection. Because this is in a search skill where arbitrary user input is expected, the context makes exploitation especially straightforward and severe.

Content

Scanner excerpt · git_federation_searcher.py (reported line 289)May include surrounding context.

python
search_query = f"site:codeberg.org OR site:gitea.com OR site:notabug.org {query}"
            cmd = f'SEARXNG_URL=http://127.0.0.1:8080 python3 /root/.openclaw/workspace/skills/searxng-bangs/scripts/search.py "{search_query}" --num 10'
            
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            
            if result.returncode == 0:
                data = json.loads(result.stdout)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises capabilities consistent with network, shell, file read, and file write access, but it does not declare any explicit tool scope or permissions boundaries in the skill manifest. Because the skill supports adding custom instances and API token use, the lack of scoped permissions increases the risk of unintended outbound requests, unsafe command execution paths, or writing sensitive configuration data without clear operator control.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill persists instance configuration and API tokens under a local workspace path, which is more sensitive behavior than a simple transient search utility. In a multi-skill or shared environment, undisclosed credential storage increases the risk of token exposure and violates least surprise for users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

API tokens supplied for private instances are serialized to instances.json in plaintext without warning, encryption, or access controls visible in the code. If the workspace is readable by other processes, users, backups, or logs, those tokens can be stolen and reused against private Git services.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · git_federation_searcher.py (reported line 131)May include surrounding context.

python
def _detect_type(self, url: str) -> str:
        """Try to detect Git instance type"""
        try:
            result = subprocess.run(
                ["curl", "-s", "-m", "5", f"{url}/api/v1/version"],
                capture_output=True,
                text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · git_federation_searcher.py (reported line 145)May include surrounding context.

python
# Try GitLab
        try:
            result = subprocess.run(
                ["curl", "-s", "-m", "5", f"{url}/api/v4/version"],
                capture_output=True,
                text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · git_federation_searcher.py (reported line 160)May include surrounding context.

python
def _test_instance(self, instance: GitInstance) -> bool:
        """Test if instance is reachable"""
        try:
            result = subprocess.run(
                ["curl", "-s", "-m", "5", "-o", "/dev/null", "-w", "%{http_code}", 
                 f"{instance.url}/api/v1/version"],
                capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User queries and optional access tokens are sent to remote Git instances, and the tokens are included in URL query strings instead of headers. This not only creates an undisclosed data-sharing/privacy issue but also increases leakage risk through process listings, HTTP logs, intermediary infrastructure, and server access logs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · git_federation_searcher.py (reported line 186)May include surrounding context.

python
if instance.api_token:
                    url += f"&access_token={instance.api_token}"
                
                result = subprocess.run(
                    ["curl", "-s", "-m", "10", url],
                    capture_output=True,
                    text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · git_federation_searcher.py (reported line 217)May include surrounding context.

python
if instance.api_token:
                    url += f"&access_token={instance.api_token}"
                
                result = subprocess.run(
                    ["curl", "-s", "-m", "10", url],
                    capture_output=True,
                    text=True

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

When primary searches fail, the skill silently forwards the user's query to a SearXNG service through an external script without warning. In context, this is riskier because it changes the destination and handling of user data unexpectedly and is implemented via a shell command that adds additional exploitation surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The fallback behavior expands the skill's capabilities from repository-instance search into arbitrary execution of another local script via a shell. In context, that broader execution path matters because it increases attack surface and creates an unexpected trust boundary crossing, especially when coupled with unsanitized user input.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

This builds a shell command containing the user-controlled query and executes it with shell=True, which enables command injection. An attacker can break out of the quoted search term and run arbitrary shell commands in the skill's execution context, making this materially more dangerous than the skill's stated search functionality.

Content

Scanner excerpt · git_federation_searcher.py (reported line 289)May include surrounding context.

python
search_query = f"site:codeberg.org OR site:gitea.com OR site:notabug.org {query}"
            cmd = f'SEARXNG_URL=http://127.0.0.1:8080 python3 /root/.openclaw/workspace/skills/searxng-bangs/scripts/search.py "{search_query}" --num 10'
            
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            
            if result.returncode == 0:
                data = json.loads(result.stdout)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file exposes a Telegram bot command surface for the skill, which materially expands the attack surface beyond simple search functionality described in the skill metadata. A chat-driven interface can be invoked by any user the bot serves, and it forwards user-controlled input into backend search and instance-management logic, increasing the chance of misuse, data exposure, or abuse of network capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The /gitadd command allows users to add arbitrary Git instance URLs through chat, effectively exposing administrative configuration and outbound network access to untrusted users. If add_instance performs connectivity checks or stores the instance for later searches, this can enable SSRF, internal network probing, persistence of attacker-controlled endpoints, and expansion of future search activity toward malicious or private hosts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest description in _meta.json narrows the skill to searching self-hosted Git instances '(Gitea, Forgejo, GitLab)'. However, the provided skill context states it also aggregates results from public services like Codeberg.org, Gitea.com, OpenDev, NotABug, and Gitdab and supports fallback to SearXNG web search, which is materially broader than the manifest text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill emits user-facing strings such as "Git-Suche", "Ergebnisse", and other CLI messages exclusively in German. This imposes a specific language on users without offering a locale choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.