ClawHub
Back to skill

Security audit

FRITZ!Box

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to control FRITZ!Box routers as advertised, but it needs review because it handles powerful router credentials and includes underprotected credential and release-script practices.

Install only if you are comfortable giving the skill credentials that can control your router and smarthome devices. Use a dedicated least-privilege FRITZ!Box account, avoid passing passwords on the command line, create and protect any .env file carefully, and treat WLAN/reconnect/smarthome actions as disruptive commands requiring explicit confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Warning
Location
fritzbox.py:99
Finding

Authentication and Session Material Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
fritzbox.py:436
Finding

Router Password Accepted through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Python Runtime Dependency Is Not Reproducibly Pinned

Content
View full analysis
=2.28.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version. Every installation may therefore resolve to a different future release of `requests` and its transitive dependencies. The effective dependency set can change without a corresponding change to this repository or a review of the newly selected code. This does not establish that the current `requests` package is malicious. It is a supply-chain hardening deficiency because builds are not reproducible and no hashes are provided to verify downloaded artifacts. ### Attack Path 1. A maintainer or user runs `pip install -r requirements.txt`. 2. The package resolver selects the newest compatible package and transitive dependency versions available at that time. 3. A compromised, malicious, or unexpectedly incompatible future release is downloaded. 4. The package is imported by `fritzbox.py` and executes with the user's privileges. 5. The compromised dependency may access process environment variables, local files readable by the process, router credentials, and network resources. ### Impact Assessment A malicious dependency executes in the same Python process as the Skill. It could access `FRITZBOX_USER`, `FRITZBOX_PASSWORD`, `FRITZBOX_HOST`, loaded `.env` values, and router responses. It would also inherit the operating-system permissions of the user running the Skill. The practical likelihood is reduced by the use of a well-known package name from the normal Python ecosystem, but the lack of exact versions and integrity hashes prevents reproducible verification. ]]>
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
tmp/publish.sh:37
Finding

Release Script Downloads and Executes an Unpinned Latest Package

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:134
Finding

Documented Credential File Is Not Protected by the Claimed Git Ignore Rule

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (26)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 23)May include surrounding context.

Copy the example environment file and fill in your credentials:

bash
cp .env.example .env
# Edit .env with your FRITZ!Box credentials

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

Copy the example environment file and fill in your credentials:

bash
cp .env.example .env
# Edit .env with your FRITZ!Box credentials

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 24)May include surrounding context.

bash
cp .env.example .env
# Edit .env with your FRITZ!Box credentials

Example .env:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

bash
cp .env.example .env
# Edit .env with your FRITZ!Box credentials

Example .env:

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Git inspection, tagging, pushing, and publishing are materially different from home router control and introduce supply-chain and source-code exposure risks. Hiding release automation inside a device-control skill makes the skill context more dangerous because users may authorize it expecting LAN-only device actions, not repository or publication operations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Git inspection, tagging, pushing, and publishing are materially different from home router control and introduce supply-chain and source-code exposure risks. Hiding release automation inside a device-control skill makes the skill context more dangerous because users may authorize it expecting LAN-only device actions, not repository or publication operations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Git inspection, tagging, pushing, and publishing are materially different from home router control and introduce supply-chain and source-code exposure risks. Hiding release automation inside a device-control skill makes the skill context more dangerous because users may authorize it expecting LAN-only device actions, not repository or publication operations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

The skill explicitly relies on credentials stored in environment variables or passed on the command line, which creates a real credential-handling risk. In this context the risk is heightened because FRITZ!Box credentials can authorize impactful router and smarthome changes, and command-line secrets may leak into shell history or process listings.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
## Authentication

### Option 1: .env File (Recommended)

Create a `.env` file:

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The skill automatically loads credentials from multiple .env locations at import time, including a hard-coded path in the user's home workspace. In an agent-skill context, implicit credential harvesting from local files is sensitive because it broadens access to secrets without explicit user action and could expose or misuse router credentials if the skill is invoked unexpectedly.

Content

Scanner excerpt · fritzbox.py (reported line 19)May include surrounding context.

python
import re
import os

# Try to load .env file
def load_env_file(path='.env'):
    """Load environment variables from .env file."""
    env_paths = [

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The load_env_file helper is specifically designed to ingest .env content into process environment variables, which constitutes access to potentially sensitive credentials. In this skill, those credentials can control a router and smart-home devices, making implicit secret loading more dangerous than in a read-only utility.

Content

Scanner excerpt · fritzbox.py (reported line 20)May include surrounding context.

python
import os

# Try to load .env file
def load_env_file(path='.env'):
    """Load environment variables from .env file."""
    env_paths = [
        path,

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

Including a parent-directory .env path expands the trust boundary and may unintentionally pull credentials from unrelated project configuration. That increases the chance of accidental secret exposure or use of credentials the operator did not intend this skill to consume.

Content

Scanner excerpt · fritzbox.py (reported line 21)May include surrounding context.

python
# Try to load .env file
def load_env_file(path='.env'):
    """Load environment variables from .env file."""
    env_paths = [
        path,
        os.path.join(os.path.dirname(__file__), '..', '.env'),

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The hard-coded fallback to ~/.openclaw/workspace-main/skills/fritzbox/.env is especially concerning because it targets a specific user-local secrets location automatically. In an agent environment, hard-coded secret discovery paths are a red flag because they facilitate opportunistic credential access beyond what a user may expect from a single command invocation.

Content

Scanner excerpt · fritzbox.py (reported line 24)May include surrounding context.

python
"""Load environment variables from .env file."""
    env_paths = [
        path,
        os.path.join(os.path.dirname(__file__), '..', '.env'),
        os.path.expanduser('~/.openclaw/workspace-main/skills/fritzbox/.env')
    ]

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The loop over env_paths operationalizes secret discovery from multiple filesystem locations, increasing the attack surface for credential ingestion. While the apparent purpose is convenience, in a security review this is still a true secret-access concern because it silently imports credentials into runtime state.

Content

Scanner excerpt · fritzbox.py (reported line 25)May include surrounding context.

python
env_paths = [
        path,
        os.path.join(os.path.dirname(__file__), '..', '.env'),
        os.path.expanduser('~/.openclaw/workspace-main/skills/fritzbox/.env')
    ]
    
    for env_path in env_paths:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-skill.py (reported line 69)May include surrounding context.

python
exclude = {
    'node_modules', '.git', '__pycache__', '.DS_Store',
    'coverage', '.vscode', '.idea', '*.pyc', '*.skill',
    '.env',
}

def should_exclude(rel_path: str) -> bool:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documented commands include WAN reconnect and power/state-changing smarthome actions without warning that they can interrupt connectivity or alter physical device state. In the context of a router/smarthome control skill, this increases the chance of unintended denial of service, user lockout, or disruptive device behavior if commands are run mistakenly or automated unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README instructs users to pass credentials directly on the command line (--user admin --password secret), which can expose secrets through shell history, terminal logs, and process listings visible to other local users. For a router administration tool, disclosure of these credentials can enable unauthorized access to the FRITZ!Box and connected smarthome functions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to sensitive environment variables and implies networked/router control, but it does not define an explicit permission or allowed-tools boundary. In an agent setting, missing scope declarations can lead to over-broad execution context and unintended access to credentials, files, or network functions beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Broad triggers like 'router', 'wlan', and 'wifi' can cause the skill to activate in many unrelated conversations. In this skill's context, accidental invocation is more dangerous than usual because the documented actions include disruptive network changes and smart-device power control.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
## Security Guidance

- **Least privilege:** Create a dedicated FRITZ!Box user with limited permissions for agent use rather than using the admin account.
- **Protect credentials:** Keep `.env` outside version control (it is listed in `.gitignore`). Restrict file permissions: `chmod 600 .env`.
- **Verify the host:** Ensure `FRITZBOX_HOST` points to your own local router. Do not route credentials through untrusted hosts.
- **Scope of access:** The configured account can authorize all router and smarthome changes supported by this skill. Treat the credentials with the same care as router admin credentials.

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · fritzbox.py (reported line 134)May include surrounding context.

python
"""Get authentication challenge from FRITZ!Box."""
        try:
            # Try to get challenge via login_sid.lua
            resp = requests.get(f'http://{self.host}/login_sid.lua', timeout=10)
            resp.raise_for_status()
            
            # Parse challenge from XML response

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · fritzbox.py (reported line 289)May include surrounding context.

python
"""Get authentication challenge from FRITZ!Box."""
        try:
            # Try to get challenge via login_sid.lua
            resp = requests.get(f'http://{self.host}/login_sid.lua', timeout=10)
            resp.raise_for_status()
            
            # Parse challenge from XML response

Tainted flow: 'login_url' from requests.get (line 302, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · fritzbox.py (reported line 167)May include surrounding context.

python
try:
            login_url = f'http://{self.host}/login_sid.lua?username={quote(self.user)}&response={response}'
            resp = requests.get(login_url, timeout=10)
            resp.raise_for_status()
            
            # Parse SID from response

Tainted flow: 'login_url' from requests.get (line 302, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · fritzbox.py (reported line 303)May include surrounding context.

python
try:
            login_url = f'http://{self.host}/login_sid.lua?username={quote(self.user)}&response={response}'
            resp = requests.get(login_url, timeout=10)
            resp.raise_for_status()
            
            # Parse SID from response

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The script executes npx clawhub@latest publish, which fetches and runs the latest package version at publish time rather than a pinned, reviewed version. This creates a supply-chain risk: a compromised upstream package, malicious new release, or unexpected breaking change could execute arbitrary code in the publisher's environment and potentially access repository credentials or modify release artifacts.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows any future version to be installed and makes builds non-reproducible. This can inadvertently introduce vulnerable or breaking releases into a router/smarthome control skill that likely performs network and authentication operations.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0