Security audit

Workspace Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill tries to protect workspace file access, but its own boundary-check examples include unsafe path handling that could undermine that protection.

Install only if you are comfortable treating it as advisory guidance rather than a reliable enforcement layer. Before using its snippets, replace the eval path expansion, make path canonicalization fail closed, define one canonical workspace root, and move audit logging inside that root with structured escaping and retention limits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/boundaries.md:168
Finding: Arbitrary Command Execution Through Unsafe Path Expansion
Content: View full analysis
Remediation: View remediation
&2 return 1 } ``` ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:72
Finding: Workspace Boundary Bypass Through Fail-Open Canonicalization
Content: View full analysis
/dev/null || echo "$path") case "$abs_path" in "$workspace"/*) return 0 ;; *) return 1 ;; esac } ``` ### Technical Analysis The guard attempts to canonicalize a path with `realpath`, but falls back to the original, uncanonicalized input when resolution fails: ```bash realpath "$path" 2>/dev/null || echo "$path" ``` The subsequent security decision is a string-prefix comparison. If canonicalization fails, traversal components, unresolved symlinks, or other non-canonical path elements can remain in the value being checked. A raw string can begin with the expected workspace prefix while ultimately identifying a location outside that workspace when used by a later filesystem operation. This is a fail-open design: failure of the security normalization step causes validation to continue with less trustworthy data instead of rejecting the request. ### Attack Path 1. An attacker supplies a non-canonical path that begins with `/home/iamlegend/.openclaw/workspace/`. 2. The path includes traversal components or refers to a target that cannot be resolved during the initial check. 3. `realpath` fails. 4. The fallback returns the original path unchanged. 5. The `case` statement approves it because the raw string begins with the workspace prefix. 6. A subsequent filesystem operation resolves the path according to actual filesystem semantics. 7. The resulting operation can reach a target outside the intended workspace boundary. The precise exploitability depends on the filesystem state and the behavior of the later operation, but the documented guard does not safely enforce the claimed boundary when canonicalization fails. # ...[truncated 346 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/boundaries.md:122
Finding: Audit Log Injection and Boundary-Inconsistent Persistent Logging
Content: View full analysis
> /workspace/memory/audit.log } ``` Related instructions also require blocked attempts to be logged and recommend tracking all violations. The selected log path, `/workspace/memory/audit.log`, is inconsistent with the declared workspace root of `/home/iamlegend/.openclaw/workspace`. ### Technical Analysis The function writes attacker-influenced `operation` and `path` values directly into a delimiter-based persistent log. It does not encode newline characters, carriage returns, delimiters, terminal control sequences, or other untrusted content. An attacker can therefore construct a path or operation containing line breaks and text that resembles legitimate audit entries. When appended, that input can create forged records or alter how later tools and reviewers interpret the log. Sensitive path names may also be retained indefinitely because no minimization or retention policy is defined. In addition, the hard-coded destination does not reside under the Skill's declared workspace root. Following this example may therefore cause the logging mechanism itself to violate the boundary that the Skill is intended to enforce. ### Attack Path 1. An attacker requests access to a path containing embedded newline characters and a forged audit-record payload. 2. Workspace Guard blocks the operation and invokes `log_violation`. 3. The function interpolates the path into an `echo` command without structured encoding. 4. The embedded newline causes one attacker-controlled value to appear as multiple log records. 5. A reviewer or automated parser later treats the injected record as genuine. 6. If the process can ...[truncated 752 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (15)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/boundaries.md (reported line 106)May include surrounding context.
md
fi # Check for destructive commands if echo "$cmd" | grep -qiE 'rm -rf|dd|:(){:|>|chmod 777'; then echo "UNSAFE: Destructive operation" return 1 fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/boundaries.md (reported line 125)May include surrounding context.
md
fi # Check for destructive commands if echo "$cmd" | grep -qiE 'rm -rf|dd|:(){:|>|chmod 777'; then echo "UNSAFE: Destructive operation" return 1 fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/boundaries.md (reported line 123)May include surrounding context.
text
### Common Dangerous Patterns - `rm -rf /` - Catastrophic delete - `:(){ :|:& };:` - Fork bomb - `chmod 777 /` - Open all permissions - `dd if=/dev/zero of=/dev/sda` - Disk wipe

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/boundaries.md (reported line 123)May include surrounding context.
text
### Common Dangerous Patterns - `rm -rf /` - Catastrophic delete - `:(){ :|:& };:` - Fork bomb - `chmod 777 /` - Open all permissions - `dd if=/dev/zero of=/dev/sda` - Disk wipe

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/boundaries.md (reported line 127)May include surrounding context.
md
- `:(){ :|:& };:` - Fork bomb - `chmod 777 /` - Open all permissions - `dd if=/dev/zero of=/dev/sda` - Disk wipe - `> /etc/passwd` - Overwrite system files ## Audit Logging

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example eval "echo \"$path\"" | realpath performs shell evaluation on untrusted path input, which can trigger command substitution or other shell metacharacter expansion before boundary checks occur. In a workspace-guard skill whose purpose is to enforce path safety, documenting eval as a path-normalization technique is especially dangerous because consumers may copy it directly into enforcement logic.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description says to use the skill before "ANY file operation" including common actions like read, write, and edit. For a markdown skill description, this activation language is very broad and does not provide clear exclusion conditions or narrower trigger phrases, which could cause unintended invocation during ordinary conversation about files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents multiple workspace roots and aliases, but its enforcement examples and guard logic rely on a single hardcoded path. In a boundary-enforcement skill, contradictory rules can cause operators or downstream agents to believe a path is permitted when the implemented check would reject it, or vice versa if callers normalize differently, weakening a security control through ambiguity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The stated allowed paths include aliases such as ~/openclaw/workspace and relative paths, but the sample case statement and guard_path function only allow one hardcoded absolute prefix. Because this skill is supposed to prevent unauthorized filesystem access, mismatched examples can lead integrators to deploy incomplete checks that fail open in wrappers or encourage unsafe manual exceptions when legitimate paths are blocked.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document defines the workspace root as /home/iamlegend/.openclaw/workspace, but the logging example writes blocked-attempt records to /workspace/memory/audit.log. For a skill whose purpose is strict workspace-boundary enforcement, documenting writes to a different absolute root contradicts the declared boundary model and could place audit data outside the allowed workspace.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/boundaries.md (reported line 65)May include surrounding context.
md
## Operation Classification ### Safe (Auto-Approve Within Workspace) - `read` - File reads - `cat`, `less`, `head`, `tail` - View operations - `ls`, `find`, `tree` - Listing

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/boundaries.md (reported line 106)May include surrounding context.
md
fi # Check for destructive commands if echo "$cmd" | grep -qiE 'rm -rf|dd|:(){:|>|chmod 777'; then echo "UNSAFE: Destructive operation" return 1 fi

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/boundaries.md (reported line 125)May include surrounding context.
md
fi # Check for destructive commands if echo "$cmd" | grep -qiE 'rm -rf|dd|:(){:|>|chmod 777'; then echo "UNSAFE: Destructive operation" return 1 fi

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/boundaries.md (reported line 127)May include surrounding context.
md
- `:(){ :|:& };:` - Fork bomb - `chmod 777 /` - Open all permissions - `dd if=/dev/zero of=/dev/sda` - Disk wipe - `> /etc/passwd` - Overwrite system files ## Audit Logging

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation recommends environment-variable path expansion using eval without any warning, which normalizes an unsafe practice and can lead downstream implementations to execute attacker-controlled shell content. Even as an example, this undermines the skill's security model because boundary enforcement code is often reused verbatim.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.