T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search-events.sh:7- Finding
Untrusted interests are embedded directly into an agent instruction
- Content
View full analysis
- Remediation
View remediation
Security audit
IT Events
Security checks for vulnerabilities and agentic risk
Overview
This event-finding skill is not clearly malicious, but it needs review because its helper scripts can create recurring OpenClaw jobs and silently ignore the requested location and language.
Install only if you are comfortable with a skill that can create an OpenClaw weekly job and write event history under the OpenClaw workspace. Before using the cron setup, verify the scheduled message, intended location, language, state file, and deletion command; avoid passing untrusted free-form text as interests.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-cron.sh:10- Finding
Prompt injection can be persisted in a recurring OpenClaw cron job
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/search-events.sh:7- Finding
Documented location input is ignored and replaced with a hardcoded country
- Content
View full analysis
" "" "$SKILL_DIR/scripts/setup-cron.sh" "" "" ``` ### Technical Analysis The skill documentation requires the caller to provide interests and a location as separate arguments. Both scripts only read `${1:-}` and never read `${2:-}`. They then insert the fixed location `Ukraine` into the agent instruction. Consequently, a caller requesting another country or `worldwide` receives behavior inconsistent with the documented security and data-quality boundary. The scripts also fail to reject a missing location, contrary to the documented requirement not to search or create automation until the location is known. ### Attack Path 1. A caller invokes either documented interface with an interests argument and a non-Ukrainian location. 2. The script reads the interests but silently ignores the second ar ...[truncated 609 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
While parts of the analyzer text are inaccurate, the skill does include a materially important behavior not disclosed in the metadata description: it can install a persistent recurring cron job via setup-cron.sh. Undisclosed persistence and automation increase risk because a user invoking an event-finding skill may not expect long-lived scheduled execution on the host.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
While parts of the analyzer text are inaccurate, the skill does include a materially important behavior not disclosed in the metadata description: it can install a persistent recurring cron job via setup-cron.sh. Undisclosed persistence and automation increase risk because a user invoking an event-finding skill may not expect long-lived scheduled execution on the host.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill creates and updates a persistent local state file for deduplication without any user-facing notice in the description. Undisclosed storage is risky because it retains behavioral history across sessions and can surprise users or operators who expect a stateless search helper.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill can create persistent recurring cron jobs through a local script, which exceeds the narrowly described purpose of finding events and returning links. Persistence on the host is security-relevant because it creates ongoing execution beyond the immediate user interaction and could be abused if the script or its dependencies are later modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The cron setup introduces system-level persistence and recurring automation, but the skill text does not require a strong warning about those side effects before execution. This is dangerous because recurring background jobs can continue to access resources or modify files long after the original request, increasing operational and security risk.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The wrapper hard-codes searches to Ukraine and ignores the advertised worldwide and user-selected location behavior, causing the skill to misrepresent its scope and potentially steer users to incomplete or biased results. In an agent setting, this kind of hidden prompt constraint undermines user intent and can lead to incorrect decisions based on silently narrowed search criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forces Ukrainian-only output regardless of user preference, which is a hidden behavior override in the agent prompt. While not a direct code-execution issue, it can degrade usability, obscure results for users expecting another language, and contribute to deceptive mismatch between the skill's description and actual behavior.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s user-facing messages are written only in Ukrainian, and the generated cron message explicitly instructs the skill to "Return the digest in Ukrainian." This enforces a specific language/locale choice without offering the user an option to select or opt into that language, which matches the policy-violation category for language constraints.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill finds upcoming IT events worldwide based on user-selected interests and location. The cron message hardcodes 'Find new future IT events in Ukraine', which materially narrows the behavior to a single country rather than honoring the broader worldwide/location-driven scope.
- Content