Metaskill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:40 AM UTC
• Version: 1.3.0

Overview

This skill mostly does what it claims, but it can silently send task details and saved learning notes to a different external LLM provider than the user selected.

Review this skill before installing if you handle confidential projects. Use it only if you are comfortable with task/error text and excerpts of saved learning notes being sent to configured LLM providers, and be aware that the current fallback logic may use a different remote provider when the selected one fails. Treat the .learnings and memory report files as persistent records that may need redaction or cleanup.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/llm_provider.py:43

Finding

Silent Cross-Provider Disclosure of Sensitive Task and Learning Data

Content

View full analysis

Vulnerability Details

File Location: scripts/llm_provider.py:43-58; data originates from scripts/llm_extract.py:6-13 and scripts/llm_transfer.py:5-14,31-48
Vulnerability Type: Unapproved external data transmission caused by automatic provider fallback
Risk Level: High

Vulnerable Code

scripts/llm_provider.py:43-58:

python

def call_llm(prompt: str, provider_type: str = "fast", max_tokens: int = 500) -> str | None:
    """
    Call LLM using configured provider.
    provider_type: "fast" (haiku-level) or "deep" (sonnet-level)
    Returns text string or None on failure.
    """
    cfg = _load_config()
    if not cfg:
        return _fallback(prompt, max_tokens)

    provider = cfg.get("providers", {}).get(provider_type, "anthropic")
    model = cfg.get("models", {}).get(provider, {}).get(provider_type, None)
    env_var = cfg.get("env_vars", {}).get(provider, "")

    result = _call_provider(provider, model, prompt, max_tokens, env_var)
    if result is not None:
        return result

    # Fallback: try the other provider
    other_provider = "openai" if provider != "openai" else "anthropic"
    other_model = cfg.get("models", {}).get(other_provider, {}).get(provider_type)
    other_env = cfg.get("env_vars", {}).get(other_provider, "")
    return _call_provider(other_provider, other_model, prompt, max_tokens, other_env)

scripts/llm_transfer.py:5-14:

python

def get_analogous_principles(task_desc, learnings_content):
    prompt = f"""Given this task:
"{task_desc}"

Which of these past learnings are analogically relevant? Explain the connection. Return ONLY valid JSON in this format:
{{"principles": [{{"principle": "...", "reasoning": "..."}}]}}

Past learnings:
{learnings_content}"""

    result = call_llm(prompt, provider_type="deep", max_tokens=500)

scripts/llm_extract.py:6-13:

python

def extract_levels(error_desc):
    prompt
...[truncated 3097 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic cross-provider fallback from call_llm(). Fail closed or use the existing offline heuristic when the selected provider fails.
2. Never fall back from Ollama to a remote provider unless the user has explicitly enabled remote fallback.
3. Add separate configuration such as:

   yaml

   fallback:
     enabled: false
     allowed_providers: []
   

4. Require affirmative consent before transmitting persistent learning records to any external provider.
5. Display the effective destination before submission, including whether processing is local or remote.
6. Fail closed when config.yaml cannot be parsed. Do not silently replace user configuration with remote-provider defaults.
7. Validate provider_type, provider names, and model selections against an explicit allowlist.
8. Add prompt redaction for common secrets, credentials, tokens, private keys, and sensitive identifiers.
9. Minimize submitted content and provide a local-only mode that cryptographically or structurally prevents remote network calls.
10. Add tests verifying that an Ollama failure never causes an external request unless explicit remote fallback consent is configured.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/eval.sh:125

Finding

Evaluation Script Recursively Reads the Entire Agent Memory Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/eval.sh:125
Vulnerability Type: Excessive filesystem access beyond the evaluation feature's minimum requirements
Risk Level: Medium

Vulnerable Code

scripts/eval.sh:125:

bash

TRANSFER_USES=$(grep -rl "transfer-check" "$WORKSPACE/memory/" 2>/dev/null | wc -l | tr -d ' '); TRANSFER_USES=${TRANSFER_USES:-0}

Technical Analysis

The monthly evaluation only needs to determine how often the transfer-check feature has been used. Instead of maintaining a dedicated counter or inspecting a Metaskill-specific audit record, the script recursively searches every readable file under $WORKSPACE/memory/.

The grep -r operation opens unrelated memory files even though their contents are not required for Metaskill operation. Agent memory can contain conversation artifacts, confidential task context, user preferences, operational notes, or data created by unrelated skills.

Suppressing errors with 2>/dev/null also hides evidence that unexpected paths, inaccessible files, or special filesystem objects were encountered. The current implementation does not transmit the matched contents, but it violates least-privilege data-access principles and expands the sensitive-data exposure surface of the evaluation command.

Attack Path

1. An operator runs scripts/eval.sh, including the documented monthly --save workflow.
2. The script resolves $WORKSPACE from the repository root or OPENCLAW_WORKSPACE.
3. grep -rl recursively traverses $WORKSPACE/memory/.
4. Every readable file encountered is opened and searched for the string transfer-check.
5. Unrelated agent memory is accessed even though only a usage count is needed.
6. If the memory tree contains links or files managed by other components, the scan can extend the accessed scope within the behavior supported by the local grep implementation and filesystem permissions.

Impact Assessment

...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Record transfer-check invocations in a dedicated Metaskill-owned counter or append-only usage log.
2. Restrict evaluation to a documented file such as:

   text

   skills/metaskill/.learnings/USAGE.log
   

3. If daily notes must be inspected, use an explicit allowlist of known filenames and a bounded date range rather than recursively scanning the entire memory tree.
4. Reject or carefully handle symbolic links when scanning any user-controlled directory.
5. Add file-count and file-size limits to prevent expensive unbounded scans.
6. Report access errors clearly instead of suppressing all diagnostics, while ensuring error output does not disclose sensitive paths.
7. Document the exact files the evaluation command accesses and ensure those accesses are limited to data necessary for the reported metrics.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/llm_provider.py (reported line 102)May include surrounding context.

python

data = json.dumps({"model": model, "prompt": prompt, "stream": False}).encode()
            req = urllib.request.Request("http://localhost:11434/api/generate",
                                         data=data, headers={"Content-Type": "application/json"})
            with urllib.request.urlopen(req, timeout=30) as r:
                return json.loads(r.read())["response"]
        except Exception as e:
            print(f"[llm_provider] ollama error: {e}", file=sys.stderr)

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The Gemini request embeds the API key directly in the URL query string, which can expose credentials through logs, proxies, monitoring systems, or exception traces outside the application. While sending a request to an external provider is expected for this module, placing secrets in the URL is an avoidable credential-handling weakness.

Content

Scanner excerpt · scripts/llm_provider.py (reported line 117)May include surrounding context.

python

url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}"
            body = json.dumps({"contents": [{"parts": [{"text": prompt}]}]}).encode()
            req = urllib.request.Request(url, data=body, headers={"Content-Type": "application/json"})
            with urllib.request.urlopen(req, timeout=30) as r:
                resp = json.loads(r.read())
                return resp["candidates"][0]["content"]["parts"][0]["text"]
        except Exception as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose frames the skill as reflective learning support, but the content also indicates configuration loading, API-key usage, provider routing, and communication with external LLM services. That mismatch is dangerous because users may invoke the skill expecting local reasoning assistance while it may actually access secrets and send task content to remote systems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose frames the skill as reflective learning support, but the content also indicates configuration loading, API-key usage, provider routing, and communication with external LLM services. That mismatch is dangerous because users may invoke the skill expecting local reasoning assistance while it may actually access secrets and send task content to remote systems.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/eval.sh (reported line 66)May include surrounding context.

sh

echo "   Deep provider : $DEEP_PROVIDER / $DEEP_MODEL $([ "$DEEP_READY" = "True" ] && echo "✅" || echo "❌ missing key")"
  else
    echo "   Version: v1.0 fallback (Manual extraction mode)"
    echo "   No LLM provider ready. Edit skills/metaskill/config.yaml and set the required env var."
    echo "   Fast: $FAST_PROVIDER → needs \$$(python3 -c "import sys; sys.path.insert(0,'$SCRIPT_DIR'); from llm_provider import _load_config; c=_load_config(); print(c['env_vars'].get(c['providers']['fast'],'?'))" 2>/dev/null)"
  fi
else

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable scripts and references capabilities such as environment-variable access, file reads, and network-backed providers, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this can cause the agent or operator to underestimate what the skill may access or transmit, increasing the chance of unintended secret exposure or unauthorized network use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script creates and writes to a persistent learnings file in the workspace without making that side effect explicit before use. Because it stores user-supplied error descriptions and derived principles/habits, it can persist sensitive operational details or secrets into a predictable location, increasing the risk of unintended retention and later disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script initializes a persistent file under the workspace without warning the user that running it may modify long-lived state. In a tool that accepts free-form error text, this can cause sensitive debugging context or internal data to be silently retained, which is a security and privacy concern even if the write itself is not malicious.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest describes a skill for teaching agents to learn better through deep correction, transfer learning, and pattern recognition, but does not indicate that it will invoke a separate Python-based LLM extraction step. Calling an LLM helper may be an additional capability beyond the stated purpose, especially since the script presents it as an optional automated extraction mode rather than a necessary implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script appends the supplied error description, principle, and habit directly into a persistent markdown file without advance disclosure or sanitization. This creates a clear data retention risk: users may paste incident details, credentials, stack traces, or proprietary content expecting transient processing, but the script silently preserves them for future access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a metaskill focused on deep correction, transfer learning, and pattern recognition workflows, but this file primarily acts as a general multi-provider LLM router that selects vendors and falls back across providers. That is a broader operational capability than the stated pedagogical/analysis purpose and is not described in the manifest text.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as helping agents learn from errors and successes, not as credentialed integration infrastructure. Reading ANTHROPIC_API_KEY, OPENAI_API_KEY, and GOOGLE_API_KEY introduces secret-handling and external service access capabilities that are not explicitly justified by that purpose statement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

User-supplied prompts are sent to third-party LLM providers with no user-facing disclosure or confirmation in the code path. In this skill's context, prompts may include reflective analysis, task context, or sensitive operational data, making silent external transmission more dangerous than in a clearly networked assistant integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code can transmit arbitrary prompts to external services and a local inference endpoint without any visible consent, policy enforcement, or data classification checks. In a metaskill context, prompts may contain prior task history, errors, or sensitive workspace content, which increases the risk of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/llm_provider.py (reported line 100)May include surrounding context.

python

try:
            import urllib.request, json
            data = json.dumps({"model": model, "prompt": prompt, "stream": False}).encode()
            req = urllib.request.Request("http://localhost:11434/api/generate",
                                         data=data, headers={"Content-Type": "application/json"})
            with urllib.request.urlopen(req, timeout=30) as r:
                return json.loads(r.read())["response"]

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest frames the skill as teaching agents to learn better through correction, transfer learning, and pattern recognition, with this script specifically labeled as a pre-task analogy lookup. In addition to lookup, the code creates .learnings directories and initializes LEARNINGS.md, which is a behaviorally broader side effect than a read/check operation and is not implied by the script's stated lookup role.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states that it writes learning data to disk, including into another skill's directory when present, but it does not prominently warn about persistence, retention, or the kinds of potentially sensitive task/error data that may be stored. This can lead to accidental retention of secrets, prompts, internal project details, or failure data in workspace files that are later committed, shared, or indexed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

When run with --save, the script creates and overwrites a dated markdown report in the workspace, and earlier it also creates learning/error files if missing. Although the behavior is visible in code, there is no confirmation prompt and no user-facing warning at the point of write describing that files will be created or modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The function sends raw user-provided error text to an external LLM via call_llm without any disclosure, consent flow, or visible minimization in this file. Error descriptions often contain sensitive data such as file paths, stack traces, API keys, tokens, customer data, or internal prompts, so forwarding them off-box can create an unintended data exfiltration path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This shell script appends user-supplied arguments into WINS.md and may also create learning files earlier in execution, but it provides no upfront warning that it will modify files in the workspace. Although it prints a success message after writing, there is no pre-action disclosure, confirmation prompt, or other user-facing warning before the file modification occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The comment describes a passive fallback to an existing learnings directory, but the implementation actively mutates the workspace by creating the directory and seeding a markdown file. This is a meaningful intent mismatch because a reader would expect selection of an alternate source, not creation of new state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script silently creates the .learnings directory and initializes LEARNINGS.md if the fallback path is used. Although this is a modest file write, there is no confirmation prompt, no user-facing disclosure before the write, and the surrounding comments are developer-facing rather than warning the user about modifying workspace files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.