Clawwork

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:11 PM UTC
• Version: 1.0.0

Overview

This skill is a thin ClawWork launcher that can run unverified local code with user API keys, so users should review its trust boundary before installing.

Install only if you already trust the local ClawWork checkout at ~/.openclaw/workspace/ClawWork and understand that task prompts and API keys may be available to that code and to configured model/sandbox providers. Prefer a pinned, verified ClawWork installation, restrict file permissions on the ClawWork directory and .env file, and avoid using this skill for confidential business data until the external-code and temp-file handling are tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: cli.py:13
• Finding: Unverified External Code Executes with API Credentials in Its Environment## Vulnerability Details **File Location**: `cli.py:13-19` and `cli.py:137`; supporting execution paths at `quick_task.py:10-15` and `clawwork.sh:7-14` **Vulnerability Type**: Unsafe execution of mutable external dependencies **Risk Level**: High ### Vulnerable Code ```python # Adiciona o ClawWork ao path CLAWWORK_PATH = Path("/home/freedom/.openclaw/workspace/ClawWork") sys.path.insert(0, str(CLAWWORK_PATH)) sys.path.insert(0, str(CLAWWORK_PATH / "livebench")) # Carrega variáveis de ambiente from dotenv import load_dotenv load_dotenv(CLAWWORK_PATH / ".env") ``` ```python # Importa e executa o agente from agent.live_agent import LiveAgent ``` The quick-task wrapper establishes the same trust boundary: ```python # Adiciona paths sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork") sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork/livebench") # Carrega .env from dotenv import load_dotenv load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env") ``` The shell wrapper also sources executable code from that external installation: ```bash CLAWWORK_DIR="/home/freedom/.openclaw/workspace/ClawWork" SKILL_DIR="/home/freedom/.openclaw/workspace/skills/clawwork" # Ativa o ambiente Python source "$CLAWWORK_DIR/venv/bin/activate" # Executa o CLI python "$SKILL_DIR/cli.py" "$@" ``` ### Technical Analysis The Skill prepends two fixed external directories to Python's module search path and imports executable modules from them. These external files are not included in the audited package, and the Skill does not verify their version, ownership, permissions, signature, or content integrity. Because these directories are inserted before normal dependency resolution, a malicious module placed there could also spoof an expected package such as `dotenv`. In the main execution flow, API credentials are loaded from `/home/freedom/.openclaw/workspace/ClawWork/.env` befor ...[truncated 2009 chars]
• Remediation: ## Remediation Suggestions - Package the required runtime code with the Skill or install it as a version-pinned dependency from an authenticated source. - Pin the external ClawWork dependency to a reviewed commit or release and verify a cryptographic hash or signature before execution. - Do not prepend broad writable directories to `sys.path`. - Import dependencies from an isolated virtual environment whose ownership and permissions are validated. - Verify that the external workspace and every parent directory are not writable by untrusted users. - Avoid sourcing mutable activation scripts. Execute a verified Python interpreter directly, for example through a fixed virtual-environment interpreter path. - Load only the credentials required for the selected operation, and pass them directly to a verified component rather than exposing all `.env` entries to the complete process. - Run external task agents in a restricted subprocess or container with a minimal environment, limited filesystem access, and network egress controls. - Document the external code and credential trust boundary explicitly in the installation instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: cli.py:118
• Finding: Predictable Shared Temporary Configuration Permits Race Conditions and Symlink Attacks## Vulnerability Details **File Location**: `cli.py:118-123` and `cli.py:180-183` **Vulnerability Type**: Unsafe temporary-file creation **Risk Level**: Medium ### Vulnerable Code ```python # Salva configuração temporária config_path = CLAWWORK_PATH / "livebench" / "configs" / "_temp_clawwork.json" config_path.parent.mkdir(parents=True, exist_ok=True) with open(config_path, "w") as f: json.dump(config, f, indent=2) ``` ```python finally: # Limpa configuração temporária if config_path.exists(): config_path.unlink() ``` ### Technical Analysis Every invocation writes task configuration to the same predictable pathname. The file is opened with ordinary write mode, which follows symbolic links and does not provide exclusive creation. File permissions depend on the process umask rather than being explicitly restricted. The configuration contains the user-supplied task prompt and execution parameters. Concurrent Skill invocations can overwrite, consume, or delete each other's configuration. If an attacker can create entries in the configuration directory, the attacker can pre-create `_temp_clawwork.json` as a symbolic link, causing the Skill to truncate and overwrite the linked target file. Cleanup also operates on the shared pathname rather than a uniquely owned temporary file. One execution may therefore delete a file created by another execution or interact with a path replaced during a race. ### Attack Path **Symlink attack:** 1. An attacker with write access to `ClawWork/livebench/configs` creates `_temp_clawwork.json` as a symbolic link to a file writable by the victim. 2. The victim runs `cli.py run`. 3. `open(config_path, "w")` follows the symbolic link and truncates the target. 4. The generated JSON configuration is written into the target file. 5. Cleanup unlinks the shared path, potentially obscuring evidence of the link. **Concurrent execution attack:** 1. Two tasks ...[truncated 824 chars]
• Remediation: ## Remediation Suggestions - Create a unique temporary file with `tempfile.NamedTemporaryFile`, `tempfile.mkstemp`, or a private `TemporaryDirectory`. - Use exclusive creation and permissions equivalent to `0600`. - Keep the returned file descriptor open while writing, rather than reopening a predictable pathname. - Place temporary files in a directory owned by the current user and inaccessible to other users. - Pass the unique configuration path directly to the agent instead of relying on a shared conventional filename. - Ensure each invocation deletes only the file it created. - Where supported, reject symbolic links using secure open flags such as `O_NOFOLLOW`. - Validate ownership and permissions of the configured ClawWork directory before writing sensitive task data.

T09 · Insecure Skill Coding Practices

Warning

• Location: quick_task.py:36
• Finding: User-Controlled Task Text Is Rendered as a Shell-Injectable Command## Vulnerability Details **File Location**: `quick_task.py:36` **Vulnerability Type**: Shell command injection through unsafe generated instructions **Risk Level**: Medium ### Vulnerable Code ```python print(f" python /home/freedom/.openclaw/workspace/skills/clawwork/cli.py run -t '{task_description}'") ``` ### Technical Analysis The wrapper inserts untrusted `task_description` content into a shell command enclosed by single quotes. It does not escape an embedded single quote. An attacker-controlled task can therefore close the quoted argument and append shell operators and commands. The wrapper only prints the command and does not execute it directly, so exploitation requires a user or another automation component to copy or execute the generated instruction. This additional interaction reduces exploitability but does not make the output safe, particularly because the text is explicitly presented under an instruction to execute it. ### Attack Path 1. An attacker supplies a task description containing shell syntax, for example: ```text x'; touch /tmp/clawwork-compromised; # ``` 2. The wrapper generates output equivalent to: ```bash python /home/freedom/.openclaw/workspace/skills/clawwork/cli.py run -t 'x'; touch /tmp/clawwork-compromised; #' ``` 3. A user or automation system follows the displayed instruction and executes it in a shell. 4. The shell treats the injected semicolon as a command separator. 5. The injected command runs with the privileges of the user who copied or executed the generated command. ### Impact Assessment If the displayed command is executed, an attacker can run arbitrary shell commands with the executing user's privileges. This can expose files and credentials accessible to the user, alter workspace data, install user-level persistence, or invoke network commands. The vulnerability is not triggered merely by running `quick_task.py`; execution of the unsafe ge ...[truncated 28 chars]
• Remediation: ## Remediation Suggestions - Do not present shell commands assembled from untrusted input as directly executable instructions. - Prefer invoking the CLI internally with an argument array, without a shell. - If a displayable shell command is necessary, quote the task with `shlex.quote`: ```python import shlex safe_task = shlex.quote(task_description) print( " python " "/home/freedom/.openclaw/workspace/skills/clawwork/cli.py " f"run -t {safe_task}" ) ``` - Clearly label generated command text as informational and avoid encouraging blind copy-and-paste execution. - Where automation consumes the output, provide structured arguments such as JSON rather than executable shell syntax. - Add tests covering single quotes, command substitutions, newlines, semicolons, and other shell metacharacters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the skill claims to execute professional tasks and perform economic measurement but in practice only exposes static instructions and local path references, that mismatch can mislead an agent into invoking it with inappropriate trust. The mention of local data locations and configuration files without clearly bounded behavior also increases the risk of unnecessary filesystem access not obvious from the top-level description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the skill claims to execute professional tasks and perform economic measurement but in practice only exposes static instructions and local path references, that mismatch can mislead an agent into invoking it with inappropriate trust. The mention of local data locations and configuration files without clearly bounded behavior also increases the risk of unnecessary filesystem access not obvious from the top-level description.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

# Executar tarefa (requer E2B_API_KEY)
skill clawwork run -t "Criar análise de mercado"
skill clawwork run -t "Gerar plano de marketing" -m kimi-coding/k2p5
```

### Uso Direto

• Confidence: 90% confidence
• Finding: The skill supports selecting an external model/provider for task execution, which can route user prompts, workspace content, or sensitive business data to third-party services. In this skill's context—professional task execution with possible document generation, analysis, and local workspace references—that creates a meaningful risk of uncontrolled data egress and compliance issues.

Credential Access

High

• Category: Privilege Escalation

Content

sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork")
sys.path.insert(0, "/home/freedom/.openclaw/workspace/ClawWork/livebench")

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Carrega .env
from dotenv import load_dotenv
load_dotenv("/home/freedom/.openclaw/workspace/ClawWork/.env")

async def quick_task(task_description: str):
    """Executa uma tarefa rápida sem configuração complexa"""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill advertises executable workflows, direct script invocation, environment-based API keys, and access to workspace paths, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file and environment access, increasing the chance of unintended secret exposure or filesystem interaction.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance is extremely broad: 'use when needing complex work, documents, analyses, or automation' effectively covers many user tasks. Overbroad triggers can cause an agent to invoke the skill unnecessarily, exposing local files, environment variables, or external providers in situations where a simpler and safer path would suffice.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly shows secret variable assignments in a plaintext .env file, including live-looking API key formats and exact storage location. This encourages operators to store sensitive credentials in a predictable path and can lead to accidental disclosure through logs, screenshots, commits, or overbroad file access by other skills.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains user-facing natural-language strings in Portuguese, beginning with the module description and continuing throughout the CLI interaction. Because the skill does not offer language selection or explain that it is intentionally Portuguese-only, it may violate language/locale policy requirements.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill description says ClawWork should execute professional tasks, generate documents, perform analyses, or automate work with cost/benefit measurement. In this implementation, the main function merely echoes the request, prints guidance for manual execution, and enumerates directories under an existing data path; it does not actually carry out the requested work.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function docstring at L18 claims it 'executes a quick task without complex configuration.' However, the inline comments at L23-L24 and subsequent print statements show that the function is only a placeholder that displays instructions and requires the user to run another command later.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: The documentation presents '/clawwork' with a broad natural-language task request, but it does not clarify whether this exact command is required, what variants are accepted, or what requests should not activate the skill. That ambiguity increases the risk of accidental or inconsistent invocation behavior.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The module docstring describes the skill only in Portuguese, which can indicate a language-specific constraint without any stated user opt-in or justification. The policy for this audit flags natural-language locale restrictions when a skill appears to impose a language choice implicitly.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The docstring, usage text, and all user-facing print messages are written in Portuguese, which implies a fixed locale for interaction. The file does not offer an opt-in language choice or document a justified region-specific constraint, which matches the language/locale policy concern.

Static analysis

No suspicious patterns detected.