ClawHub
Back to skill

Security audit

cwd-guardian

Security checks for vulnerabilities and agentic risk

Overview

This skill appears non-malicious, but its documentation materially overstates recovery behavior and it writes persistent process/path state to a hardcoded OpenClaw workspace path.

Review this before installing: it is not evidence of theft or destruction, but it does not do what it claims. Do not rely on it to restore a missing working directory or restart evolver unless the implementation is fixed, and verify whether writing process/path state under the hardcoded OpenClaw workspace is acceptable for your environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill documentation claims it will restore or recreate a missing working directory, but the described behavior also includes process inspection and persistent metadata writes that are not clearly disclosed as part of the core purpose. More importantly, the mismatch between claimed recovery behavior and actual behavior can cause operators to rely on a safety mechanism that does not really restore state, leading to failed recovery, incorrect process restarts, and exposure of filesystem/path metadata in a persistent file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description promises that the skill 'monitors and restores' the evolver process working directory, and the module comment says it 'recreates it before starting.' In practice, the code only checks whether paths exist, logs status, inspects running processes, and writes a JSON state file; it never calls mkdir on the missing recorded cwd or changes any process cwd.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The header comment states 'If cwd is missing, recreates it before starting,' which describes an active repair step tied to process startup. The implementation only reports missing cwd, validates the evolver skill root, checks for running daemon PIDs, and saves state, while also stating elsewhere that lifecycle management is handled by another component.

Content

No source excerpt is available for this finding.