Build a Software Development Team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it needs review because it can make broad, persistent changes to agents, install unpinned dependency skills, and delegate sensitive repository actions.

Install only after reviewing the side effects: it will configure agents, write persistent coordination files, schedule heartbeats, install dependency skills, clone repositories, and enable PM chat completions. Pin every dependency skill to a trusted publisher/version, validate project names and repo SSH URLs, keep token values in a secret manager, and require an explicit human confirmation with PR number and branch before any merge to main.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:287

Finding

Unpinned Third-Party Skills Selected Through a Mutable Popularity Ranking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:287-305
Vulnerability Type: Untrusted and unpinned dependency installation
Risk Level: High

Vulnerable Code Snippet:

text

### Dependency Skills (Required — Install First)

DEPENDENCY SKILLS — install these first on each agent:

All agents:
  - Asana skill (for Asana task management)

Agents that touch code (engineer, dev-fe, dev-be, qa, n8n_engineer):
  - Git skill (for repository operations)

PM agent only:
  - Email skill (for Dev Manager completion alerts)

Search ClawHub for the best-rated version of each if not already installed.

### EncryptShawn Workflow Skills (All Agents)

- openclaw-administrator
- openclaw-recovery-manager
- approved-self-improver

Technical Analysis

The setup procedure instructs the Agent to search ClawHub and install the “best-rated” version of several dependency Skills. It does not pin an exact publisher, package slug, version, or integrity digest for the Asana, Git, and email dependencies. Popularity and rating are mutable discovery signals rather than security boundaries.

Consequently, the effective dependency selected during installation can differ from the dependency that was previously reviewed. An attacker could exploit ranking manipulation, publisher impersonation, typosquatting, or compromise of a currently popular package. Installing the selected dependencies on multiple Agents amplifies the exposure. The unconditional inclusion of approved-self-improver further increases the potential consequences because self-modification capabilities are not required merely to provision a development team.

Attack Path

1. An attacker publishes or compromises a ClawHub Skill matching a requested dependency category, such as an Asana, Git, or email Skill.
2. The attacker manipulates ratings or otherwise causes that package to appear as the “best-rated” result.
3. During team setup, the Agent follows ...[truncated 1221 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace popularity-based selection with an explicit allowlist containing the trusted publisher, exact package slug, and reviewed version for every dependency.
2. Pin a cryptographic integrity digest or signed release identity where the platform supports it.
3. Require operator confirmation before installing any dependency that is not already on the allowlist.
4. Perform a static review of each dependency's instructions, scripts, requested permissions, network behavior, and credential access before installation.
5. Record the resolved owner, version, and digest in the project configuration to support reproducible setup and future audits.
6. Apply least privilege per role. For example, do not install email functionality outside the PM Agent, and limit Git permissions to only the required repositories and operations.
7. Remove approved-self-improver from the default installation set unless the operator explicitly requests it and accepts its additional trust implications.
8. Reject similarly named, newly published, unsigned, or ownership-changed packages until manually reviewed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:616

Finding

Shell Command Injection Through Unquoted User-Controlled Setup Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:616-619
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code Snippet:

bash

cd ~/.openclaw/projects/[project_name]/workspace
git clone [repo_ssh_url] repo
mkdir -p mockups

Technical Analysis

The Skill gathers project_name and repository SSH URLs from the user during setup and later interpolates those values into shell commands. The command template does not specify input validation, shell-safe quoting, argument-array execution, or an end-of-options delimiter.

If placeholders are replaced verbatim and the resulting text is executed through a shell, command separators, command substitutions, redirections, whitespace, or other shell metacharacters in a crafted project name or repository value can alter the intended command. A malicious project name can affect the cd command, while a malicious repository string can affect the git clone invocation.

Quoting alone is not a complete defense if validation and process invocation remain unsafe. Repository values must be parsed as Git SSH URLs, project identifiers must be restricted to a safe character set, and Git should be invoked through a process API that passes each argument separately rather than constructing a shell command string.

Attack Path

1. An attacker supplies a crafted project name or repository SSH URL during the information-gathering step.
2. The setup workflow substitutes the supplied value into the documented command template.
3. The setup Agent executes the generated command through a shell.
4. The shell interprets attacker-provided metacharacters or substitutions as additional syntax rather than as literal data.
5. The injected command executes with the operating-system privileges and environment of the setup Agent.
6. The attacker may then read or modify accessible files, alter the OpenClaw project configuration, tamper with cloned source code, o ...[truncated 898 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate project_name before using it in any path. Use a strict allowlist such as ^[A-Za-z0-9._-]+$, reject . and .., and enforce a reasonable maximum length.
2. Resolve the final project directory and verify that its canonical path remains beneath the intended ~/.openclaw/projects/ root.
3. Parse repository inputs and accept only approved SSH Git URL forms, such as [e-mail]:organization/repository.git, with an optional allowlist of permitted hosts and organizations.
4. Invoke Git with a process execution API and a fixed argument array equivalent to ["git", "clone", validatedRepoUrl, "repo"]. Do not build a shell command through string concatenation.
5. Create directories through a filesystem API. If a shell is unavoidable, quote every expanded path safely and use end-of-options delimiters where supported.
6. Reject shell metacharacters, control characters, newlines, leading option markers, command substitutions, and unexpected whitespace in all values used by commands.
7. Run repository cloning and project initialization with a dedicated least-privileged account and a minimal environment.
8. Add negative tests covering semicolons, pipes, redirections, backticks, $() substitutions, embedded newlines, path traversal sequences, and option-injection inputs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

This skill collects only the *names* of env vars (e.g., `TA_ASANA_PAT`) — never their values. Those env var names are passed to the dependency skills so they know which credential to pull from the agent runtime environment.

Credentials must be stored in your secret management system (Kubernetes ConfigMap/Secret, .env file, or equivalent) before setup begins.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 633)May include surrounding context.

text

Credential check — confirm in your secret management system:

- [ASANA_PAT_ENV_VAR_NAME] — Asana personal access token
- [GITHUB_PAT_ENV_VAR_NAME] — GitHub personal access token
- [DEV_MANAGER_EMAIL_ENV_VAR_NAME] — Dev Manager email address

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 634)May include surrounding context.

text

Credential check — confirm in your secret management system:

- [ASANA_PAT_ENV_VAR_NAME] — Asana personal access token
- [GITHUB_PAT_ENV_VAR_NAME] — GitHub personal access token
- [DEV_MANAGER_EMAIL_ENV_VAR_NAME] — Dev Manager email address

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger criteria are very broad and include ambiguous phrases that could cause the skill to activate in contexts where the user did not intend full administrative setup. Because this skill performs agent configuration, file creation, and repo wiring, over-triggering can lead to unintended system modifications or premature collection of infrastructure details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill carries out substantial state-changing operations such as writing workspace files, changing agent configuration, enabling chat completions, and cloning repositories, but it does not present a consolidated upfront warning at the beginning. Users may not realize the scope of modifications until deep into execution, increasing the risk of unsafe or accidental changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill instructs persistent writing of per-agent workspace files including HEARTBEAT.md, USER.md, TOOLS.md, and AGENTS.md. While these are framed as operational state, persistent cross-session files can become a durable control surface that influences future agent behavior, expanding the blast radius of mistakes or malicious edits and creating a persistence mechanism within the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 437)May include surrounding context.

md

---

## Step 6 — Write Agent Workspace Files

Using the openclaw-administrator skill, write the following files for each agent.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow explicitly instructs the QA agent to merge a pull request to main on operator instruction, giving an AI agent direct authority over a potentially destructive repository action. Even though a human review step exists, the document does not require an explicit safety confirmation checklist, branch protection verification, or a narrowly scoped non-destructive merge mechanism, so a mistaken, spoofed, or context-confused instruction could result in unintended code being merged to production.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The security model section states that the skill does not 'read, store, request, or transmit any credentials or secret values,' yet it immediately says the skill collects env-var names and Step 1 asks the user to provide those names. Env-var names are not secret values, so this is not a dangerous credential leak, but the documentation's 'does not request' wording contradicts the actual intake behavior described in the file.

Content

No source excerpt is available for this finding.