Security audit

Property Advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with property search and publishing, but it needs Review because it can execute auto-discovered upstream skill code and stores sensitive property/search data locally.

Install only if you are comfortable with an execution-layer property tool that runs other local skills, contacts public OSM services, and keeps local housing/search state. Prefer setting explicit trusted OK/GT skill roots, avoid running it in untrusted workspaces, use `--no-memory` for private searches, clear `~/property-advisor/` and OSM cache when needed, and review all publishing payloads before using `--confirm-submit`.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

Location: property_advisor/gt_client.py:27
Finding: Untrusted upstream Skill discovery executes spoofed workspace code during capability probing
Content: View full analysis
list[Path]: cwd = Path.cwd() codex_home = Path(env.get("CODEX_HOME") or (Path.home() / ".codex")).expanduser() roots: list[Path] = [] for raw_value in ( custom_root, env.get("GT_CORE_SKILL_ROOT"), env.get("PROPERTY_GT_SKILL_ROOT"), cwd / ".agents" / "skills" / "gt-core-skill", cwd / ".agents" / "skills" / "gumtree-skills", cwd / "skills" / "gt-core-skill", cwd / "skills" / "gumtree-skills", codex_home / "skills" / "gt-core-skill", codex_home / "skills" / "gumtree-skills", Path.home() / ".codex" / "skills" / "gt-core-skill", Path.home() / ".codex" / "skills" / "gumtree-skills", "/Users/a58/Desktop/gt-core-skill/gt-core-skill-cli/gt-core-skill/gumtree-skills", str(Path.home() / "Desktop" / "gt-core-skill" / "gt-core-skill-cli" / "gt-core-skill" / "gumtree-skills"), "/Users/a58/Desktop/gt-core-skill/gumtree-skills", str(Path.home() / "Desktop" / "gt-core-skill" / "gumtree-skills"), "/Users/a58/Desktop/gt-core-skill", str(Path.home() / "Desktop" / "gt-core-skill"), ): if not raw_value: continue candidate = Path(raw_value).expanduser() for expanded in ( candidate, candidate / "gumtree-skills", candidate / "gt-core-skill-cli" / "gt-core-skill" / "gumtree-skills", ): if expanded not in roots: roots.append(expanded) return roots def resolve_gt_skill_root( custom_root: str | Path | None = None, env: dict[str, str] | None = None, runner: Runner | None = None, ) -> tuple[Path, str]: env ...[truncated 3213 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: property_advisor/gt_client.py:571
Finding: GT publishing leaves sensitive property and contact data in persistent temporary files
Content: View full analysis
dict[str, Any]: payload = gt_publish_payload(request) with tempfile.NamedTemporaryFile("w", encoding="utf-8", suffix=".json", delete=False) as handle: json.dump(payload, handle, ensure_ascii=False, indent=2) payload_file = handle.name args = ["publish-listing", "--payload-file", payload_file] if request.publish_endpoint: args.extend(["--endpoint", request.publish_endpoint]) if not submit: args.append("--dry-run") return self._run_json(args, timeout=120) ``` The generated payload can contain the following sensitive fields: ```python if request.location or request.postcode or request.address: payload["location"] = { key: value for key, value in { "postcode": request.postcode, "display_name": request.location, "address": request.address, }.items() if value } if request.images: payload["images"] = list(request.images) contact = { "name": request.contact_name, "email": request.contact_email, "phone": request.phone, "whatsapp": request.whatsapp, } clean_contact = {key: value for key, value in contact.items() if value} if clean_contact: payload["contact"] = clean_contact ``` ### Technical Analysis `NamedTemporaryFile` is opened with `delete=False`, making the file persist after the context manager closes it. The method does not use a `finally` block or any other cleanup operation to remove the file after the upstream publisher completes or fail ...[truncated 1656 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/upstream-sources.md:45
Finding: Optional HasData provider installation is unpinned and lacks integrity verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (54)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A second description-behavior mismatch reinforces that the skill promises search, watchlist, profile-memory, and publishing orchestration while evidence points to OSM/geocoding analysis and diagnostic behavior instead. In this context, misrepresentation can lead to unsafe assumptions about what data is stored, what external services are contacted, and whether business actions like publishing are actually gated as claimed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A second description-behavior mismatch reinforces that the skill promises search, watchlist, profile-memory, and publishing orchestration while evidence points to OSM/geocoding analysis and diagnostic behavior instead. In this context, misrepresentation can lead to unsafe assumptions about what data is stored, what external services are contacted, and whether business actions like publishing are actually gated as claimed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase "OpenClaw 优先的房产搜索" expresses a language preference in natural language without indicating user choice or opt-in. Under the policy, forcing or preferring a specific language or locale without explicit user selection is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that the skill persistently stores user profile, search history, and watched listings under ~/property-advisor/, but it does not clearly warn users about retention, sensitivity, or how to disable or purge storage. In a property-search context, this data can include location preferences, commute destinations, budget, and listing interests, which are privacy-sensitive and could expose behavioral patterns or personal circumstances if accessed by other local users, malware, or logs/backups.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable CLI flows, file-backed profile memory, upstream routing, and bundled map enrichment, but it declares no explicit tool scope or permission boundaries. In a skill that can touch files, shell, network, and environment state, missing scope declarations increase the chance of over-broad execution, unintended data access, or unsafe downstream tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation text is very broad, covering many common housing-related phrases and actions, which can cause the skill to trigger in contexts where a narrower tool would be safer or more appropriate. Because this skill also routes to upstream executors, reads/writes local profile memory, and may perform network enrichment, over-broad invocation increases the risk of unnecessary data handling or unintended side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The strings added to risks are hard-coded in Chinese, which forces a specific language for generated output. There is no indication in this file of user opt-in, language selection, or a justified region-specific restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The publish_property method prepares a payload and invokes a publish-listing command, optionally targeting a publish endpoint, which is a safety-relevant network operation affecting external state. In this file there is no user-facing warning, confirmation, or explanatory comment disclosing that the method can submit listing data externally when submit is enabled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The publish flow serializes listing data to a named temporary file on disk with delete=False and never removes it. That can leave property details, contact information, and other potentially sensitive listing content behind in the filesystem where other local users, processes, backups, or forensic recovery can access it. In an orchestration skill that handles publishing, this is a genuine privacy and data-retention weakness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The to_display_row method emits user-facing field names and fallback values entirely in Chinese, while the data models elsewhere default lang to en. This creates a natural-language locale policy issue because the skill appears to force a specific display language without offering a user choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest describes an execution-layer orchestrator that obtains listings through upstream skills/plugins/clients, but this implementation achieves that by invoking a locally discovered Python CLI via subprocess. Spawning local executables is a materially broader capability than ordinary property search/publishing logic and is not explicitly justified in the manifest text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: publish_property can trigger external side effects through the upstream CLI, including posting or saving listings, yet this file contains no built-in confirmation, authorization check, or safety interlock before execution. In this skill context, publishing is a sensitive action that can create real-world marketplace changes, making accidental or unauthorized invocation materially impactful.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The runtime can invoke check-login as part of preflight without any consent, warning, or policy gate in this file, which may trigger network access and account-state interactions implicitly. In a property-advisor context, hidden login/network checks are more dangerous because users may expect search orchestration, not background authentication probes against an external browser-capable skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The orchestrator emits warning messages in Chinese directly, regardless of user preference. This creates a language/locale policy issue because the file shows no natural-language choice or opt-in for these user-facing strings.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file constructs rendered results with Chinese labels such as status values, assessment text, and table headers. Because the output language is fixed in code and no opt-in or locale switch is visible here, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code persists user profile and search history data to disk under the user's home directory without any indication of consent, notice, retention controls, or access restrictions in this component. In a property-advisor skill, the stored fields can include location, destination, budget, preferences, watched listings, and search history, which are sensitive behavioral and financial signals and can be exposed to other local users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The publish request interface hard-codes lang: str = "en" as the default, which imposes a specific language/locale choice in a user-facing publishing workflow. In this file there is no accompanying natural-language opt-in or choice mechanism, so users may be forced into English listing content even when their input is in another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The routing logic returns a user-facing error string in Chinese when multiple external sources are detected. This forces a specific language regardless of the user's locale or preferences, which is a natural-language policy violation under the locale/language rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This branch returns a Chinese error message for mixed UK and non-UK geography signals. Because the file provides no user language selection or documented region-specific constraint, the skill appears to enforce a specific language unconditionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The unavailable-source messages are hard-coded in Chinese, which imposes a specific language on users regardless of their preferred locale. The file does not document any region-specific justification or provide a language choice, so this is a natural-language locale policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The geocoding flow sends listing-derived address, location, title, or description text to external services (Photon and Nominatim). In a property-search context, that text can contain precise home addresses or sensitive user-associated location data, and this file provides no consent gate, redaction, or disclosure before transmission, creating a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Overpass queries transmit derived geographic bounding boxes for listing locations to third-party endpoints. Even though this is less explicit than sending raw addresses, the bbox still reveals approximate property search targets and user interest areas, which is sensitive in a housing-screening workflow and is done without any explicit notice or control in this code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Multiple assessment conclusions and evidence strings are hardcoded in Chinese, which forces a specific language in generated output regardless of user preference. There is no indication in this file that the skill is region- or language-specific, nor any option for users to select their preferred language.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · public-osm-map-context-skill/tests/test_cli.py (reported line 36)May include surrounding context.
python
class CliEndToEndTest(unittest.TestCase): def test_fixture_analyze_batch(self) -> None: with tempfile.TemporaryDirectory() as tmp: proc = subprocess.run( [ sys.executable, str(CLI),

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · public-osm-map-context-skill/tests/test_cli.py (reported line 204)May include surrounding context.
python
class CliEndToEndTest(unittest.TestCase): def test_fixture_analyze_batch(self) -> None: with tempfile.TemporaryDirectory() as tmp: proc = subprocess.run( [ sys.executable, str(CLI),

Static analysis

No suspicious patterns detected.