T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned npm Dependency Permits Unreviewed Upstream Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Sageox Distill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed SageOx repository sync, indexing, and distillation workflow, with expected local CLI installation and credential use that users should understand before installing.
Install this only if you intend to use SageOx on the selected repositories and are comfortable installing the SageOx `ox` CLI plus Claude/GitHub tooling, authenticating those CLIs, and allowing the workflow to index GitHub activity and run distillation through SageOx/Claude. For tighter supply-chain control, prefer a version-pinned Claude CLI install and periodically reinstall `ox` only from reviewed skill releases.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update-ox.sh:58- Finding
Recurring ox Integrity Gate Trusts a Mutable Binary's Self-Reported Version
- Content
View full analysis
/dev/null || true)" if [ -z "$expected_ref" ]; then echo "error: $STATE_FILE is missing ox_install_ref" >&2 echo "fix: re-run the install flow from references/INSTALL.md" >&2 exit 2 fi expected_version="${expected_ref#v}" if ! version_output="$("$EXPECTED_OX" version 2>&1)"; then echo "error: $EXPECTED_OX failed to run" >&2 echo "$version_output" >&2 echo "fix: re-run the install flow from references/INSTALL.md" >&2 exit 2 fi first_line="$(printf '%s\n' "$version_output" | head -n1)" if [ "$first_line" != "ox $expected_version" ]; then echo "error: $EXPECTED_OX reports '$first_line', expected 'ox $expected_version'" >&2 echo "fix: re-run the install flow from references/INSTALL.md" >&2 exit 2 fi ``` ### Technical Analysis The initial installer validates the downloaded archive against an embedded SHA-256 digest. Subsequent readiness checks, however, do not recompute or compare the installed executable's digest. They only verify its path and execute it with the `version` argument, trusting the executable to report the expected version. Both `$HOME/.local/bin/ox` and the installation state under `~/.openclaw/memory` are user-writable. A replaced executable can print the expected version while performing additional malicious actions. The readiness gate executes the binary before establishing its integrity, so malicious logic can run during the verification step itself. This weakness does not independently cross operating-system user boundaries. Exploitation generally requires an attacker or process that already has permission to modify the victim's user-scoped files. Nevertheless, it prevents the gate from fulfilling its stated purpose of detecting replacement or c ...[truncated 1272 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a repo sync/distillation helper, but it also directs installation and validation of an external executable (
ox), including use of a bundled shell script and a referenced install flow that writes into$HOME/.local/binand persists state under~/.openclaw/memory. That hidden operational scope changes the trust model: users may approve a data-processing skill without realizing it can bootstrap or replace local executables.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a repo sync/distillation helper, but it also directs installation and validation of an external executable (
ox), including use of a bundled shell script and a referenced install flow that writes into$HOME/.local/binand persists state under~/.openclaw/memory. That hidden operational scope changes the trust model: users may approve a data-processing skill without realizing it can bootstrap or replace local executables.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/update-ox.sh
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # install to $HOME/.local/bin. No sudo, no shell-script piping, no # dynamic "latest" resolution. # # Why this shape: scanners flag `curl | bash` of a remote shell script, # and skills that sudo into system paths. This script avoids both. The # release tag and per-platform sha256s are pinned in the source below, so # an attacker cannot substitute a different binary without also editing
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh resolved_ox="$(command -v ox 2>/dev/null || true)" if [ "$resolved_ox" != "$EXPECTED_OX" ]; then echo "error: 'ox' resolves to '${resolved_ox:-<not on PATH>}', not $EXPECTED_OX" >&2 echo "fix: prepend \$HOME/.local/bin to PATH in ~/.openclaw/.env so the pinned install wins" >&2 exit 2 fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh resolved_ox="$(command -v ox 2>/dev/null || true)" if [ "$resolved_ox" != "$EXPECTED_OX" ]; then echo "error: 'ox' resolves to '${resolved_ox:-<not on PATH>}', not $EXPECTED_OX" >&2 echo "fix: prepend \$HOME/.local/bin to PATH in ~/.openclaw/.env so the pinned install wins" >&2 exit 2 fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes shell commands extensively (
bash scripts/update-ox.sh,ox,gh,git) but declares no explicit tool scope or allowed-tools boundary. In an agent environment, missing capability scoping increases the chance of over-broad command execution or accidental access beyond the intended operational surface, especially because the skill also reads writable state from the user's home directory.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # dynamic "latest" resolution. # # Why this shape: scanners flag `curl | bash` of a remote shell script, # and skills that sudo into system paths. This script avoids both. The # release tag and per-platform sha256s are pinned in the source below, so # an attacker cannot substitute a different binary without also editing # this file (which is reviewed on skill publish).