Clawwork

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:11 PM UTC
• Version: 1.0.0

Overview

This skill is a thin ClawWork launcher that can run unverified local code with user API keys, so users should review its trust boundary before installing.

Install only if you already trust the local ClawWork checkout at ~/.openclaw/workspace/ClawWork and understand that task prompts and API keys may be available to that code and to configured model/sandbox providers. Prefer a pinned, verified ClawWork installation, restrict file permissions on the ClawWork directory and .env file, and avoid using this skill for confidential business data until the external-code and temp-file handling are tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: cli.py:13

Finding

Unverified External Code Executes with API Credentials in Its Environment

Content

View full analysis

Vulnerability Details

File Location: cli.py:13-19 and cli.py:137; supporting execution paths at quick_task.py:10-15 and clawwork.sh:7-14
Vulnerability Type: Unsafe execution of mutable external dependencies
Risk Level: High

Vulnerable Code

python

# Adiciona o ClawWork ao path
CLAWWORK_PATH = Path("/home/freedom/.openclaw/workspace/ClawWork")
sys.path.insert(0, str(CLAWWORK_PATH))
sys.path.insert(0, str(CLAWWORK_PATH / "livebench"))

# Carrega variáveis de ambiente
from dotenv import load_dotenv
load_dotenv(CLAWWORK_PATH / ".env")

python

# Importa e executa o agente
from agent.live_agent import LiveAgent

The quick-task wrapper establishes the same trust boundary:

python

# Adiciona paths
sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork")
sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork/livebench")

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

The shell wrapper also sources executable code from that external installation:

bash

CLAWWORK_DIR="/home/freedom/.openclaw/workspace/ClawWork"
SKILL_DIR="/home/freedom/.openclaw/workspace/skills/clawwork"

# Ativa o ambiente Python
source "$CLAWWORK_DIR/venv/bin/activate"

# Executa o CLI
python "$SKILL_DIR/cli.py" "$@"

Technical Analysis

The Skill prepends two fixed external directories to Python's module search path and imports executable modules from them. These external files are not included in the audited package, and the Skill does not verify their version, ownership, permissions, signature, or content integrity.

Because these directories are inserted before normal dependency resolution, a malicious module placed there could also spoof an expected package such as dotenv. In the main execution flow, API credentials are loaded from /home/freedom/.openclaw/workspace/ClawWork/.env befor ...[truncated 2009 chars]

Remediation

View remediation

Remediation Suggestions

• Package the required runtime code with the Skill or install it as a version-pinned dependency from an authenticated source.
• Pin the external ClawWork dependency to a reviewed commit or release and verify a cryptographic hash or signature before execution.
• Do not prepend broad writable directories to sys.path.
• Import dependencies from an isolated virtual environment whose ownership and permissions are validated.
• Verify that the external workspace and every parent directory are not writable by untrusted users.
• Avoid sourcing mutable activation scripts. Execute a verified Python interpreter directly, for example through a fixed virtual-environment interpreter path.
• Load only the credentials required for the selected operation, and pass them directly to a verified component rather than exposing all .env entries to the complete process.
• Run external task agents in a restricted subprocess or container with a minimal environment, limited filesystem access, and network egress controls.
• Document the external code and credential trust boundary explicitly in the installation instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: cli.py:118

Finding

Predictable Shared Temporary Configuration Permits Race Conditions and Symlink Attacks

Content

View full analysis

Vulnerability Details

File Location: cli.py:118-123 and cli.py:180-183
Vulnerability Type: Unsafe temporary-file creation
Risk Level: Medium

Vulnerable Code

python

# Salva configuração temporária
config_path = CLAWWORK_PATH / "livebench" / "configs" / "_temp_clawwork.json"
config_path.parent.mkdir(parents=True, exist_ok=True)

with open(config_path, "w") as f:
    json.dump(config, f, indent=2)

python

finally:
    # Limpa configuração temporária
    if config_path.exists():
        config_path.unlink()

Technical Analysis

Every invocation writes task configuration to the same predictable pathname. The file is opened with ordinary write mode, which follows symbolic links and does not provide exclusive creation. File permissions depend on the process umask rather than being explicitly restricted.

The configuration contains the user-supplied task prompt and execution parameters. Concurrent Skill invocations can overwrite, consume, or delete each other's configuration. If an attacker can create entries in the configuration directory, the attacker can pre-create _temp_clawwork.json as a symbolic link, causing the Skill to truncate and overwrite the linked target file.

Cleanup also operates on the shared pathname rather than a uniquely owned temporary file. One execution may therefore delete a file created by another execution or interact with a path replaced during a race.

Attack Path

Symlink attack:

1. An attacker with write access to ClawWork/livebench/configs creates _temp_clawwork.json as a symbolic link to a file writable by the victim.
2. The victim runs cli.py run.
3. open(config_path, "w") follows the symbolic link and truncates the target.
4. The generated JSON configuration is written into the target file.
5. Cleanup unlinks the shared path, potentially obscuring evidence of the link.

Concurrent execution attack:

1. Two tasks ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique temporary file with tempfile.NamedTemporaryFile, tempfile.mkstemp, or a private TemporaryDirectory.
• Use exclusive creation and permissions equivalent to 0600.
• Keep the returned file descriptor open while writing, rather than reopening a predictable pathname.
• Place temporary files in a directory owned by the current user and inaccessible to other users.
• Pass the unique configuration path directly to the agent instead of relying on a shared conventional filename.
• Ensure each invocation deletes only the file it created.
• Where supported, reject symbolic links using secure open flags such as O_NOFOLLOW.
• Validate ownership and permissions of the configured ClawWork directory before writing sensitive task data.

T09 · Insecure Skill Coding Practices

Warning

• Location: quick_task.py:36

Finding

User-Controlled Task Text Is Rendered as a Shell-Injectable Command

Content

View full analysis

Vulnerability Details

File Location: quick_task.py:36
Vulnerability Type: Shell command injection through unsafe generated instructions
Risk Level: Medium

Vulnerable Code

python

print(f"   python /home/freedom/.openclaw/workspace/skills/clawwork/cli.py run -t '{task_description}'")

Technical Analysis

The wrapper inserts untrusted task_description content into a shell command enclosed by single quotes. It does not escape an embedded single quote. An attacker-controlled task can therefore close the quoted argument and append shell operators and commands.

The wrapper only prints the command and does not execute it directly, so exploitation requires a user or another automation component to copy or execute the generated instruction. This additional interaction reduces exploitability but does not make the output safe, particularly because the text is explicitly presented under an instruction to execute it.

Attack Path

1. An attacker supplies a task description containing shell syntax, for example:

   text

   x'; touch /tmp/clawwork-compromised; #
   

2. The wrapper generates output equivalent to:

   bash

   python /home/freedom/.openclaw/workspace/skills/clawwork/cli.py run -t 'x'; touch /tmp/clawwork-compromised; #'
   

3. A user or automation system follows the displayed instruction and executes it in a shell.
4. The shell treats the injected semicolon as a command separator.
5. The injected command runs with the privileges of the user who copied or executed the generated command.

Impact Assessment

If the displayed command is executed, an attacker can run arbitrary shell commands with the executing user's privileges. This can expose files and credentials accessible to the user, alter workspace data, install user-level persistence, or invoke network commands.

The vulnerability is not triggered merely by running quick_task.py; execution of the unsafe ge ...[truncated 28 chars]

Remediation

View remediation

Remediation Suggestions

• Do not present shell commands assembled from untrusted input as directly executable instructions.
• Prefer invoking the CLI internally with an argument array, without a shell.
• If a displayable shell command is necessary, quote the task with shlex.quote:

  python

  import shlex
  
  safe_task = shlex.quote(task_description)
  print(
      "   python "
      "/home/freedom/.openclaw/workspace/skills/clawwork/cli.py "
      f"run -t {safe_task}"
  )
  

• Clearly label generated command text as informational and avoid encouraging blind copy-and-paste execution.
• Where automation consumes the output, provide structured arguments such as JSON rather than executable shell syntax.
• Add tests covering single quotes, command substitutions, newlines, semicolons, and other shell metacharacters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill claims to execute professional tasks and perform economic measurement but in practice only exposes static instructions and local path references, that mismatch can mislead an agent into invoking it with inappropriate trust. The mention of local data locations and configuration files without clearly bounded behavior also increases the risk of unnecessary filesystem access not obvious from the top-level description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill claims to execute professional tasks and perform economic measurement but in practice only exposes static instructions and local path references, that mismatch can mislead an agent into invoking it with inappropriate trust. The mention of local data locations and configuration files without clearly bounded behavior also increases the risk of unnecessary filesystem access not obvious from the top-level description.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill supports selecting an external model/provider for task execution, which can route user prompts, workspace content, or sensitive business data to third-party services. In this skill's context—professional task execution with possible document generation, analysis, and local workspace references—that creates a meaningful risk of uncontrolled data egress and compliance issues.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Executar tarefa (requer E2B_API_KEY)

skill clawwork run -t "Criar análise de mercado" skill clawwork run -t "Gerar plano de marketing" -m kimi-coding/k2p5

text

### Uso Direto

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quick_task.py (reported line 13)May include surrounding context.

python

sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork")
sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork/livebench")

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 21)May include surrounding context.

python

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cli.py (reported line 29)May include surrounding context.

python

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quick_task.py (reported line 15)May include surrounding context.

python

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · quick_task.py (reported line 33)May include surrounding context.

python

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence

Finding

The skill advertises executable workflows, direct script invocation, environment-based API keys, and access to workspace paths, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file and environment access, increasing the chance of unintended secret exposure or filesystem interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance is extremely broad: 'use when needing complex work, documents, analyses, or automation' effectively covers many user tasks. Overbroad triggers can cause an agent to invoke the skill unnecessarily, exposing local files, environment variables, or external providers in situations where a simpler and safer path would suffice.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly shows secret variable assignments in a plaintext .env file, including live-looking API key formats and exact storage location. This encourages operators to store sensitive credentials in a predictable path and can lead to accidental disclosure through logs, screenshots, commits, or overbroad file access by other skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains user-facing natural-language strings in Portuguese, beginning with the module description and continuing throughout the CLI interaction. Because the skill does not offer language selection or explain that it is intentionally Portuguese-only, it may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says ClawWork should execute professional tasks, generate documents, perform analyses, or automate work with cost/benefit measurement. In this implementation, the main function merely echoes the request, prints guidance for manual execution, and enumerates directories under an existing data path; it does not actually carry out the requested work.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function docstring at L18 claims it 'executes a quick task without complex configuration.' However, the inline comments at L23-L24 and subsequent print statements show that the function is only a placeholder that displays instructions and requires the user to run another command later.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation presents '/clawwork' with a broad natural-language task request, but it does not clarify whether this exact command is required, what variants are accepted, or what requests should not activate the skill. That ambiguity increases the risk of accidental or inconsistent invocation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring describes the skill only in Portuguese, which can indicate a language-specific constraint without any stated user opt-in or justification. The policy for this audit flags natural-language locale restrictions when a skill appears to impose a language choice implicitly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring, usage text, and all user-facing print messages are written in Portuguese, which implies a fixed locale for interaction. The file does not offer an opt-in language choice or document a justified region-specific constraint, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.