evez-osint-engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.0

Overview

This skill should be reviewed carefully because it tells agents to run unaudited local Python code and produce high-impact crime-probability reports about named suspects without safeguards.

Install only if you already trust and have independently verified the external evez-osint-engine code and you will use it in a lawful, consented, human-reviewed context. Treat any suspect or crime-probability output as speculative and not suitable by itself for accusations, prioritization, employment, legal, policing, or other consequential decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Execution of Unbundled and Unverified Local Python Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-25
Vulnerability Type: Execution of code from a fixed external workspace without integrity or provenance validation
Risk Level: Medium

Vulnerable Code

markdown

### Run the engine
```bash
cd /home/openclaw/.openclaw/workspace/evez-osint-engine
python3 core/suspect_matrix.py

CLI

bash

python3 core/osint_cli.py run -i input.json -o report.md -f markdown
python3 core/osint_cli.py analyze --suspect-id <id> --name <name> --role officer --org "Evanston PD"

text

### Technical Analysis

The Skill instructs users or agents to execute Python scripts from the fixed external directory `/home/openclaw/.openclaw/workspace/evez-osint-engine`. These scripts are not included in the audited project, which contains only `SKILL.md`. Their implementation, provenance, version, and security properties therefore cannot be verified by auditing this package.

The instructions do not require any cryptographic hash, digital signature, trusted package version, ownership check, or other integrity validation before execution. They also assume that the external path contains the intended engine. Python executes the referenced files with the permissions of the invoking user, so any party able to create or replace files at that location could cause arbitrary Python code to run when the documented commands are followed.

This is an insecure coding and packaging practice rather than proof that the absent scripts are themselves malicious. Exploitation depends on an attacker first obtaining write access to the referenced directory or its files.

### Attack Path

1. An attacker gains the ability to create or modify files under `/home/openclaw/.openclaw/workspace/evez-osint-engine`, whether through another local vulnerability, an insecure deployment process, or overly broad filesystem permissions.
2. The attacker places malicious code in `core/suspec
...[truncated 961 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the required implementation within the audited Skill package rather than relying on a fixed external workspace.
2. Resolve executable paths relative to the verified Skill installation directory instead of using /home/openclaw/.openclaw/workspace/evez-osint-engine.
3. If an external component is necessary, pin it to an immutable version and verify a cryptographic hash or trusted digital signature before execution.
4. Validate that executable files are regular files with expected ownership and restrictive permissions, and reject symbolic links or unexpected path substitutions.
5. Document the trusted source, installation procedure, expected version, and integrity values for the engine.
6. Run the engine in a least-privilege sandbox or container with only the filesystem and network access required for its stated purpose.
7. Add explicit failure behavior so execution stops if integrity, ownership, path, or version validation fails.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports computing 'crime probabilities' for named suspects and generating reports to disk, but it provides no warning about the severe legal, ethical, and privacy risks of inferring criminality from OSINT. This can enable defamatory profiling, wrongful targeting, or misuse in law-enforcement-like decision making, especially because the framing and CLI examples make the output appear authoritative.

Content

No source excerpt is available for this finding.