Security audit

Skill Forge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed skill-generation and publishing tool, but its scripts can write outside the intended workspace and generate executable shell files from untrusted text.

Review carefully before installing or running. Use it only in a contained, non-privileged OpenClaw workspace, avoid untrusted skill names, sources, or SKILL.md content, inspect generated shell scripts before execution, and do not use --publish or browser publishing flows until the package adds path validation, shell escaping, overwrite protection, and explicit confirmation gates.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/forge.py:125
Finding: Path Traversal Allows Skill Files to Be Written Outside the Intended Workspace
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/forge.py:148
Finding: Generated Test Script Contains Shell Command Injection
Content: View full analysis
/tmp/skillforge-command-output)' ``` 2. The source is split into the `sources` list without validation. 3. The payload is written into an `echo` command in `scripts/test.sh`. 4. The generated script is marked executable. 5. A user or automated test runner executes: ```bash /root/.openclaw/w ...[truncated 1057 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agent-line.py:12
Finding: Agent Generator Accepts Traversal and Absolute Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agent-line.py:31
Finding: Untrusted Skill Metadata Is Embedded in an Executable Deployment Script
Content: View full analysis
/tmp/agent-line-command-output)" ``` 2. Run the Agent generator for that Skill: ```bash python3 scripts/agent-line ...[truncated 1306 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description omits or understates external publishing behavior while promoting automation and deployment, which can mislead users about actions taken on third-party platforms. Hidden or poorly disclosed outbound actions are dangerous because users may trigger account-affecting publication, data transfer, or irreversible external operations without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description omits or understates external publishing behavior while promoting automation and deployment, which can mislead users about actions taken on third-party platforms. Hidden or poorly disclosed outbound actions are dangerous because users may trigger account-affecting publication, data transfer, or irreversible external operations without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description omits or understates external publishing behavior while promoting automation and deployment, which can mislead users about actions taken on third-party platforms. Hidden or poorly disclosed outbound actions are dangerous because users may trigger account-affecting publication, data transfer, or irreversible external operations without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example trigger phrases are extremely broad, such as ordinary requests to help with business needs or batch processing. Because the skill also promotes generation, deployment, and publishing workflows, such generic triggers could cause the skill to activate in unrelated conversations and initiate high-impact actions the user did not specifically request.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The publishing automation section describes automated interaction with external platforms, form filling, confirmation, and screenshot capture, but provides no clear warning about account actions, privacy exposure, credential handling, or third-party terms/compliance. In context, this is particularly risky because automated publishing can post content publicly, leak sensitive information, or perform irreversible actions on linked accounts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises automation that implies file and shell-capable behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates ambiguity about what the agent may access at runtime, increasing the risk of over-privileged execution, unintended file modification, or command execution when the skill is invoked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The skill display name, description, and all example interactions are presented only in Chinese, with no indication that the user can choose another language or locale. This can violate language/locale policy expectations when a skill effectively imposes one language by default without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description strongly promotes automatic generation and one-click deployment without warning that these actions may modify files, invoke tools, or affect external systems. This increases the likelihood that a user invokes the skill without understanding operational consequences, especially in an environment with code, shell, or publishing capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code writes a shell script into the skill directory and then marks it executable with chmod. While the generated script itself is described as a deployment artifact, there is no direct warning or confirmation that a new executable file will be created and permissions changed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's natural-language interface, examples, and generated content are all written in Chinese, and there is no indication that users may opt into another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generated markdown embeds Chinese headings, instructions, and example dialogues as the default interaction format. Because this output is produced for arbitrary user demands without locale negotiation, it enforces a language choice rather than letting the user opt in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest explicitly mentions generating fusion plans, SKILL.md, test frameworks, batch pipelines, and one-click deployment templates. However, this function performs an actual marketplace publication action by invoking clawhub publish -y, which goes beyond template generation into external release/distribution behavior.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 94% confidence
Finding: The script executes an external CLI command to publish a generated skill, which creates a real side effect outside the local process boundary. Although it uses a fixed argument list rather than a shell string, this still enables unintended external actions if the tool is run in a sensitive environment or with untrusted generated content, especially because publication is part of the workflow.
Content: Scanner excerpt · scripts/forge-pro.py (reported line 378)May include surrounding context.
python
with open(config_path, 'w') as f: json.dump(claw_config, f, ensure_ascii=False, indent=2) result = run(["clawhub", "publish", "-y"], cwd=skill_dir, capture_output=True, text=True) return result.stdout + result.stderr

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill will generate a fusion plan, SKILL.md, and a test framework. In this code path, the tool generates SKILL.md, agent configuration, and claw.json publishing metadata, but there is no logic that creates any test framework or test files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic publication can occur when the --publish flag is supplied, and the script provides no interactive confirmation, explicit warning, or review gate before performing an external marketplace action. In a skill-generation context, this is more dangerous because the tool creates artifacts from user input and can immediately push them publicly, enabling accidental data exposure, policy violations, or publication of unsafe content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script creates directories and writes multiple files under a fixed workspace path based on user-supplied input, without confirmation, dry-run support, or validation against overwriting existing content. In an agent/automation context, implicit filesystem writes can cause unintended persistence, clobber existing skills, or be chained with crafted names to write outside the intended directory if path components such as '..' or slashes are accepted.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L214-L215 的注释和输出文案明确表示“IMA知识库也存一份”“存入IMA知识库中”，但后续没有任何与 IMA 相关的文件写入、API 调用或数据持久化逻辑。这里不是简单的文档不完整，而是直接宣称发生了一个额外动作，与真实行为相矛盾。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code creates or overwrites agent-config.json in the target skill directory. Although the script's top-level docstring says it outputs files, there is no explicit pre-action warning or confirmation before modifying files in place, which qualifies as a missing disclosure for a file write operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function writes workflow.md directly to the skill directory and does not check whether an existing file will be replaced. There is no confirmation prompt or explicit warning near the operation explaining that user files may be modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code performs file writes to existing skill files and backup files in --optimize, --optimize-all, and --demand flows. Although some success messages appear after writing, the command usage text does not clearly warn users beforehand that these modes will modify files in place.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring, usage text, and subsequent user-facing messages consistently force a specific language/locale. Under the policy, language constraints should either offer user opt-in/choice or be explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated page sets lang="zh-CN", and surrounding user-facing strings throughout the script are exclusively Chinese, which effectively forces a specific language/locale. The file does not provide any user opt-in, alternative locale selection, or documentation that this skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.