T09 · Insecure Skill Coding Practices
Error
- Location
scripts/parser.py:104- Finding
Sensitive transcript arguments and error output are retained in plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Reliability
Security checks for vulnerabilities and agentic risk
Overview
This observability skill is mostly coherent, but it needs review because it broadly reads local agent transcripts and can retain or send sensitive excerpts with weak controls.
Review before installing in environments where agent transcripts may contain secrets, customer data, or sensitive file paths. Keep the dashboard bound to localhost, avoid configuring external webhooks unless the destination is trusted, do not commit config.yaml after adding a webhook, and consider adding redaction-before-storage, dependency locks, retention limits, owner-only file permissions, and local bundled frontend assets.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/alerts/discord_alerter.py:16- Finding
Incomplete redaction and unrestricted webhook destinations can disclose failure data externally
- Content
View full analysis
= self.tool_failure_threshold and self._should_alert(AlertType.TOOL_FAILURE): failures = self.store.get_recent_tool_failures(tool_name, 5) last_error = failures[0]["error_message"][:200] if failures else "Unknown" alert = Alert( Severity.CRITICAL if consecutive >= 5 else Severity.WARNING, AlertType.TOOL_FAILURE, f"Tool `{tool_name}` has failed {consecutive} times consecutively", {"tool": tool_name, "consecutive_failures": consecutive, "last_error": last_error}) ``` ```python # scripts/alerts/sanitizer.py:12-24 _PATTERNS = [ # Anthropic API keys re.compile(r'sk-ant-[A-Za-z0-9\-_]{10,}'), # OpenAI / generic sk- keys re.compile(r'sk-[A-Za-z0-9\-_]{10,}'), # Slack tokens re.compile(r'xox[bparos]-[A-Za-z0-9\-]+'), # Discord and Slack webhook URLs re.compile(r'https://discord\.com/api/webhooks/[^\s"\']+'), re.compile(r'https://hooks\.slack\.com/[^\s"\']+'), # Generic webhook URLs (any path under common webhook hosts) re.compile(r'https?://[^\s"\']+/webhooks?/[^\s"\']+'), ] ``` ```python # scripts/alerts/discord_alerter.py:16-38 def __init__(self, webhook_url): if not webhook_url: raise ValueError("Discord webhook_url is required") self.webhook_url = webhook_url def send_alert(self, alert): safe_message = sanitize_text(alert.message) safe_details = sanitize_details(alert.details) embed = { "title": f"🦞 claw-reliability — {alert.alert_type.value.rep ...[truncated 3652 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
dashboard/frontend/index.html:7- Finding
Dashboard executes third-party JavaScript without integrity verification
- Content
View full analysis
``` ### Technical Analysis The dashboard downloads and executes React, ReactDOM, and Babel from a public CDN. The script tags do not include Subresource Integrity hashes, and the application does not establish a restrictive Content Security Policy. Although versioned CDN paths are used, the browser does not verify the downloaded bytes against a project-controlled cryptographic digest. Any malicious response delivered through a compromised CDN account, CDN infrastructure, DNS or TLS trust failure, or upstream asset replacement would execute with the dashboard origin's privileges. The frontend's own API requests are same-origin and do not directly send metrics to the CDN. However, CDN scripts execute in the page and can independently call the same-origin `/api/*` endpoints. This includes endpoints that expose session identifiers, alerts, metrics, and complete tool-failure rows. ### Attack Path 1. A user launches and opens the local dashboard. 2. The browser requests React, ReactDOM, and Babel from `cdnjs.cloudflare.com`. 3. A compromised or unexpectedly modified CDN response supplies malicious JavaScript. 4. Because no integrity hash or restrictive CSP blocks it, the browser executes the response in the dashboard origin. 5. The script requests local endpoints such as `/api/ ...[truncated 705 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad observability system with monitoring, usage/cost accounting, anomaly detection, alerts, and a dashboard. The supplied code chunk does not perform any of those core functions. Instead, it is a narrow helper that redacts API keys, tokens, webhook URLs, and the local home directory from alert payload text/details. While sanitizing alerts could support an observability/alerting system, this chunk’s actual behavior is materially different from the declared primary purpose and covers only a small auxiliary piece of it.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full observability capability with monitoring, usage/cost accounting, anomaly detection, alerting, and dashboarding. The supplied code chunk instead implements a narrow helper utility for sanitizing alert payloads. While alert sanitization could be a supporting component of an observability/alerting system, this chunk does not itself perform the core declared functions. Therefore, the code behavior is materially narrower and different from the declared primary purpose.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable commands that read local transcripts, write to a SQLite database, and can send alerts to external destinations, yet it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause over-broad access and make reviewers or policy engines unable to constrain file and network operations appropriately.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a monitoring and observability skill with alerts and dashboarding, which implies collecting, analyzing, and reporting telemetry. The configure-alerts command goes beyond monitoring by persisting new configuration to disk, changing the skill's runtime setup rather than just observing or reporting state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code persists a sensitive Discord webhook URL to
config.yamlin plaintext without any warning, consent prompt, or permissions hardening. If the file is later read by other local users, included in backups, committed to source control, or exposed through logs/support bundles, the webhook can be abused to send fraudulent alerts, spam a Discord channel, or interfere with incident-response trust.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends alert content and details to an external Discord webhook via HTTP POST, which can transmit user or system data off-host. The file contains no confirmation prompt, user-facing notice, or explanatory comment/docstring describing that alert contents will be sent to Discord.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes this skill as agent observability that monitors invocations, costs, anomalies, alerts, and a dashboard. While alerting itself is in scope, this command persistently rewrites the skill's configuration file to store a Discord webhook URL, which is administrative configuration management rather than monitoring behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code persists a Discord webhook URL directly into config.yaml without warning the user that this value is effectively a credential and may grant unauthorized message posting if exposed. Storing it in plaintext on disk increases the risk of accidental disclosure through backups, source control, file sharing, or permissive filesystem access.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Observability and alert delivery can justify sending notifications, but storing arbitrary webhook endpoints supplied at runtime introduces configuration/secrets handling behavior beyond passive monitoring. This is a distinct capability from collecting metrics and detecting anomalies, and it is not explicitly reflected in the manifest text.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The parser defaults to reading transcripts from ~/.openclaw/agents, which can contain sensitive prompts, tool inputs/outputs, credentials, or other user data, yet the code provides no consent gate, disclosure, scoping control, or redaction before ingesting and emitting derived events. In an observability skill, this increases privacy risk because monitoring code may process data across all agents and sessions automatically, making accidental over-collection and downstream exposure more likely.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a lower bound only, so builds may resolve to different FastAPI versions over time. This weakens supply-chain reproducibility and can unintentionally introduce vulnerable or breaking releases into deployments.
- Content
text fastapi>=0.104.0 uvicorn>=0.24.0 pyyaml>=6.0
Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
FastAPI has known advisories in some versions, and the manifest does not pin an exact release, so it is impossible to verify whether the deployed version is affected. In a network-facing observability service, that uncertainty matters because framework flaws can be remotely reachable.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The Uvicorn dependency is unpinned, allowing package resolution to drift across environments and over time. That creates supply-chain risk because a newly published vulnerable or malicious version could be installed without any manifest change.
- Content
text fastapi>=0.104.0 uvicorn>=0.24.0 pyyaml>=6.0
Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 85% confidence
- Finding
Uvicorn has known advisories in certain releases, but the current requirement does not identify which version will actually be installed. Since this skill appears to expose dashboard and API functionality, a vulnerable ASGI server could increase exposure to remote attacks.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
PyYAML is declared with only a minimum version, so the installed version is not deterministic. Because PyYAML has a history of unsafe parsing issues, version drift increases the chance of pulling in a release with security-relevant behavior or unresolved advisories.
- Content
text fastapi>=0.104.0 uvicorn>=0.24.0 pyyaml>=6.0
Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
PyYAML has multiple historical security advisories, and without an exact version pin there is no reliable way to determine whether installs are safe. This is more concerning here because observability systems often ingest configuration and event data that may originate from external or semi-trusted sources.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest mentions pluggable alerts, so sending alerts is in scope, but this file also provides credential-style configuration management by taking a webhook URL from the CLI and persisting it to config.yaml. Handling and storing integration secrets/configuration is a broader administrative capability than simple observability and is not explicitly stated in the manifest.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code persists parser state to a file via
save_state(), creating directories and writing JSON, but there is no confirmation prompt, logging, or comment/docstring warning the user that local state will be written. For a code file, file writes should have some visible disclosure unless clearly covered elsewhere.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The parser opens and reads transcript files under
~/.openclaw/agents/.../sessions/*.jsonl, which may contain user or system data, but the code provides no confirmation, visible logging, or warning comment/docstring about accessing those files. This is a data-access operation that lacks explicit disclosure in the file itself.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code creates a data directory and opens a persistent SQLite database, which causes agent metrics to be stored on disk. In this file there is no confirmation prompt, user-facing log, or comment/docstring warning that session-related telemetry will be persisted locally.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code creates a local data directory and opens a persistent SQLite database, then later records tool invocations, sessions, LLM calls, and alerts. The file contains no confirmation prompt, user-facing log/print, or explanatory comments/docstrings warning that operational data will be stored on disk.
- Content
Static analysis
No suspicious patterns detected.