T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/interrupt.py:138- Finding
Untrusted PID Marker Allows Arbitrary Process-Tree Termination
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Mission Killer
Security checks for vulnerabilities and agentic risk
Overview
The skill is an emergency agent kill-and-rollback tool, but its broad process-killing and persistent agent-file modification powers have weak safeguards and should be reviewed before use.
Install only if you need emergency interruption and rollback for OpenClaw agents and you trust the local OpenClaw configuration. Use dry-run and single-agent targeting first, avoid enabling the watcher or cron automation unless you accept persistent AGENTS.md changes, and keep separate backups because a bad marker, broad workspace match, or crafted agent ID could stop the wrong process or alter future agent behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/interrupt.py:73- Finding
Workspace Substring Matching Can Kill Unrelated Processes
- Content
View full analysis
= 2: try: pid = int(parts[-1].strip()) procs.append({"pid": pid, "cmd": line[:100]}) except ValueError: pass ``` The Unix-like path uses the same substring rule against `ps aux` output: ```python else: try: result = subprocess.run(["ps", "aux"], capture_output=True, text=True, timeout=10) for line in result.stdout.splitlines(): if workspace in line: parts = line.split() if parts: try: procs.append({"pid": int(parts[1]), "cmd": line[:100]}) except ValueError: pass ``` Every match is then forcibly terminated: ```python procs = find_procs(workspace) if not procs: print(f"[interrupt] No running processes found for {agent_id}") return print(f"[interrupt] Found {len(procs)} process(es) for {agent_id}:") for p in procs: print(f" PID={p['pid']} {p['cmd']}") if dry_run: pri ...[truncated 2816 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:35- Finding
Unsanitized Agent IDs Enable Marker-Path Traversal
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/install.py:32- Finding
Persistent Agent Instruction Injection Through Unvalidated Configuration Fields
- Content
View full analysis
""" ``` The resulting block is appended to the agent’s persistent `AGENTS.md` file: ```python def install_to_agent(agent, skill_path, dry_run=False): agent_id = agent["id"] workspace = agent.get("workspace") if not workspace: print(f" [SKIP] {agent_id}: no workspace configured") return agents_md = Path(workspace) / "AGENTS.md" if not agents_md.exists(): print(f" [SKIP] {agent_id}: AGENTS.md not found at {agents_md}") return content = agents_md.read_text(encoding="utf-8") if INTEGRATION_MARKER in content: print(f" [SKIP] {agent_id}: already integrated") return block = build_integration_block(agent_id, skill_path) if dry_run: print(f" [DRY-RUN] {agent_id}: would append integration block to {agents_md}") return with open(agents_md, "a", encoding="utf-8") as f: f.write(block) ``` `scripts/watch.py` repeats the same interpolation a ...[truncated 2863 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is framed as a targeted interrupt tool, but its broader behavior includes automatic agent discovery, configuration reads, and writing integration content into AGENTS.md files. This expands the trust boundary from a single operational action to persistent modification across agent workspaces, which is more dangerous than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is framed as a targeted interrupt tool, but its broader behavior includes automatic agent discovery, configuration reads, and writing integration content into AGENTS.md files. This expands the trust boundary from a single operational action to persistent modification across agent workspaces, which is more dangerous than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is framed as a targeted interrupt tool, but its broader behavior includes automatic agent discovery, configuration reads, and writing integration content into AGENTS.md files. This expands the trust boundary from a single operational action to persistent modification across agent workspaces, which is more dangerous than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is framed as a targeted interrupt tool, but its broader behavior includes automatic agent discovery, configuration reads, and writing integration content into AGENTS.md files. This expands the trust boundary from a single operational action to persistent modification across agent workspaces, which is more dangerous than the user-facing description suggests.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The rollback deletes the last user message and all subsequent messages, which is more destructive than the stated goal and can erase the very instruction needed for auditability and safe recovery. In this skill context, an interrupt command is explicitly designed for emergency intervention, so incorrect rollback semantics can corrupt agent history, destroy evidence, and enable unauthorized tampering with conversation state.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises capabilities that imply shell execution, environment access, and file read/write, but it does not declare any tool scope or permission boundaries. For a skill that can terminate processes, modify transcripts, and write to agent files, missing least-privilege constraints increases the chance of unintended destructive actions or abuse if invoked broadly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include broad natural-language terms like 'kill all' and '打断', which can overlap with normal conversation and cause accidental activation. Because the described actions are destructive—terminating processes and rolling back memory—ambiguous triggers materially raise the risk of unintended disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes process termination and transcript rollback as core behavior but does not present a prominent explicit warning or confirmation requirement. In context, rollback deletes the triggering user message and subsequent history, so accidental or misunderstood use can cause irreversible workflow disruption and loss of state.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation describes a background watcher/cron mechanism that auto-injects content into new agents' files, which is broader and more persistent than an on-demand interrupt skill. Automatic propagation increases blast radius and can silently alter future agents without a fresh user decision.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer persistently modifies every target agent's AGENTS.md to change future execution behavior, effectively propagating this skill's control mechanism across agents. That exceeds a narrow 'interrupt/rollback' function and creates a cross-agent trust boundary issue: once installed, many agents are instructed to route long-running Python tasks through this skill's wrapper, giving the skill durable influence over later executions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script enumerates all configured agents from openclaw.json and bulk-appends operational instructions into each workspace's AGENTS.md. In the context of a task-kill skill, this broad configuration rewriting is more dangerous because it scales a persistent behavior change across the environment, increasing blast radius if the injected protocol is incorrect, abused, or later coupled with unsafe interrupt logic.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if sys.platform == "win32": # Use WMIC which is faster than Get-WmiObject for CommandLine queries try: result = subprocess.run( ["wmic", "process", "get", "ProcessId,CommandLine", "/format:csv"], capture_output=True, text=True, encoding="utf-8", timeout=10 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python pass else: try: result = subprocess.run(["ps", "aux"], capture_output=True, text=True, timeout=10) for line in result.stdout.splitlines(): if workspace in line: parts = line.split()
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function docstring at L133 says it will kill a PID and all its children recursively, which reads as a general capability. In reality, the implementation unconditionally invokes PowerShell and WMI, so on non-Windows systems it does not perform the documented behavior and would fail if reached.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def kill_pid_tree(pid, dry_run=False): """Kill a PID and all its children recursively.""" # Get all descendant PIDs result = subprocess.run( ["powershell", "-Command", f"$pids = @({pid}); $queue = @({pid}); while ($queue.Count -gt 0) {{ $p = $queue[0]; $queue = $queue[1..($queue.Count-1)]; $children = Get-WmiObject Win32_Process | Where-Object {{ $_.ParentProcessId -eq $p }} | Select-Object -ExpandProperty ProcessId; foreach ($c in $children) {{ $pids += $c; $queue += $c }}; }}; $pids -join ','" ], capture_output=True, text=True, encoding="utf-8"
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("[interrupt] DRY-RUN: skipping kill") return True for p in all_pids: subprocess.run( ["powershell", "-Command", f"Stop-Process -Id {p} -Force -ErrorAction SilentlyContinue"], capture_output=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python for p in procs: if sys.platform == "win32": subprocess.run( ["powershell", "-Command", f"Stop-Process -Id {p['pid']} -Force -ErrorAction SilentlyContinue"], capture_output=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python capture_output=True ) else: subprocess.run(["kill", "-9", str(p["pid"])], capture_output=True) print(f"[interrupt] Killed PID {p['pid']}") # Verify all processes are dead
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script rewrites the session transcript immediately after determining what to remove, without any interactive confirmation or equivalent safeguard. In a skill whose purpose is to kill tasks and roll back sessions, this materially increases the chance of accidental or coerced destructive state changes, resulting in loss of audit trail and denial of service to the agent workflow.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python openclaw_home = find_openclaw_home() proc = subprocess.Popen(cmd_args) register(openclaw_home, args.agent, proc.pid, args.session) print(f"[run] Started PID {proc.pid} for agent {args.agent}: {' '.join(cmd_args)}")
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script enumerates all configured agents and persistently appends instructions into each agent's AGENTS.md, which is a cross-agent modification capability not necessary for a narrowly scoped interrupt/rollback function. Because AGENTS.md influences future agent behavior, this creates lasting control-plane changes outside the user’s immediate kill request and expands the skill’s authority beyond its declared purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script reads the global agent configuration, discovers other agents' workspaces, and writes persistent content into their documentation files in bulk. In the context of a kill/rollback skill, that cross-agent discovery and propagation capability is over-privileged and could be abused to influence multiple agents' future execution patterns without direct user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script writes to AGENTS.md automatically and only emits a log message after the fact, providing no prior notice or consent before making persistent behavioral changes. Silent modification of agent instruction files is dangerous because it can alter how agents operate in future sessions and bypass normal user expectations about when workspace content is being changed.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file documentation frames this as an auto-install script for "agent-interrupt," and the injected block repeatedly instructs agents to use that integration. This conflicts with the provided skill identity and purpose context for "claw-mission-killer," creating intent ambiguity about what skill is actually being installed and invoked.
- Content
Static analysis
No suspicious patterns detected.