T09 · Insecure Skill Coding Practices
Error
- Location
modules/confirm.js:34- Finding
High-Risk Operations Are Approved Without User Confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
enterprise-security-suite
Security checks for vulnerabilities and agentic risk
Overview
This security skill is not clearly malicious, but its core safety protections are unreliable and activation persistently changes the agent's memory.
Review before installing. Do not rely on this package as an enforcement-grade security layer until confirmation actually requires explicit approval, activation has documented scope and rollback, repository verification is hardened, and rollback validates backup files safely.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
modules/security-check.js:9- Finding
Official Repository Verification Can Be Bypassed with a Crafted URL
- Content
View full analysis
repository && repository.includes(url))) { return { verified: true, risk: RISK_LEVELS.LOW, message: '官方技能，来源可信' }; } if (!author || author === 'unknown') { return { verified: false, risk: RISK_LEVELS.HIGH, message: '作者未知，来源不明' }; } return { verified: false, risk: RISK_LEVELS.MEDIUM, message: '社区技能，需要进一步检查' }; } ``` ### Technical Analysis The source-verification logic grants trusted status whenever the supplied repository string contains the substring `github.com/openclaw`. Substring presence does not establish URL origin, hostname ownership, transport security, or repository ownership. For example, each of the following attacker-controlled values can contain the trusted substring without identifying an official repository: ```text https://attacker.example/?next=github.com/openclaw https://github.com/openclaw.evil.example/repository https://attacker.example/github.com/openclaw/fake-skill ``` Because a successful match sets `verified: true` and assigns a low source risk, the overall security assessment can recommend installation if the declared permissions and dependencies also appear benign. The implementation performs no actual repository lookup, signature verification, code review, dependency resolution, or ownership validation. ### Attack Path 1. An attacker publishes a malicious Skill at an attacker-controlled location. 2. The attacker supplies a repository string containing `github.com/openclaw` somewhere in the URL. 3. `checkSource()` evaluates `repository.includes('github.com/openclaw')` as true. 4. The source is mark ...[truncated 824 chars]- Remediation
View remediation
= 2 && parts[0].toLowerCase() === 'openclaw' ); } catch { return false; } } ``` ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
modules/rollback.js:9- Finding
Rollback Accepts Symbolic Links as Trusted Backup Files
- Content
View full analysis
{ if (file.startsWith(basename + '.') && file.endsWith('.bak')) { const parts = file.split('.'); if (parts.length >= 4) { const date = parts[parts.length - 3]; const sequence = parts[parts.length - 2]; backups.push({ file, path: path.join(dir, file), date, sequence, version: `${date}.${sequence}` }); } } }); backups.sort((a, b) => { if (b.date !== a.date) return b.date.localeCompare(a.date); return parseInt(b.sequence) - parseInt(a.sequence); }); if (targetVersion) { return backups.filter(b => b.version === targetVersion); } return backups; } async function rollback(options) { const { filePath, targetVersion, reason = '用户要求回滚' } = options; try { const backups = findBackups(filePath, targetVersion); if (backups.length === 0) { throw new Error(`未找到备份文件：${filePath}`); } const backupFile = targetVersion ? backups[0] : backups[0]; await backup.autoBackup({ filePath, reason: `回滚前备份（目标版本：${backupFile.version}）` }); fs.copyFileSync(backupFile.path, filePath); ``` ### Technical Analysis Backup candidates are trusted solely because their names begin with the target basename and end with `.bak`. The implementation does not use `lstatSync()` to verify that a candidate is a regular file and not a symbolic link. It also does not validate ownership, permissions, canonical paths, integrity metadata, or whether the candidate was create ...[truncated 1843 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This finding again reflects materially misleading claims about core security functionality. In a security skill, nonfunctional or overstated protections can materially increase risk because users may stop applying other safeguards under the assumption this skill covers them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding again reflects materially misleading claims about core security functionality. In a security skill, nonfunctional or overstated protections can materially increase risk because users may stop applying other safeguards under the assumption this skill covers them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding again reflects materially misleading claims about core security functionality. In a security skill, nonfunctional or overstated protections can materially increase risk because users may stop applying other safeguards under the assumption this skill covers them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding again reflects materially misleading claims about core security functionality. In a security skill, nonfunctional or overstated protections can materially increase risk because users may stop applying other safeguards under the assumption this skill covers them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding again reflects materially misleading claims about core security functionality. In a security skill, nonfunctional or overstated protections can materially increase risk because users may stop applying other safeguards under the assumption this skill covers them.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function presents a high-risk confirmation prompt but then unconditionally returns true without collecting or validating any user response. This completely defeats the stated protection and allows any caller to proceed with sensitive operations such as deleting files, modifying environment settings, or sending external messages without actual authorization.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description and primary user-facing instructions are presented in Chinese, including the manifest description and main headings, but the document does not state that the skill is China-region-specific or provide an opt-in or alternative language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
All user-facing natural-language strings and operational instructions in this file are presented only in Chinese, with no opt-in or alternative locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is justified and documented.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill presents itself as an enterprise security suite providing confirmation gates, backups, rollback, and safety checks, but the script only inserts policy text into a memory database. This creates a dangerous false sense of protection: users may rely on controls that are not actually enforced, leading to unsafe high-risk operations proceeding without real safeguards.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation output explicitly claims that the AI will automatically perform multiple security controls after restart, but no such mechanisms are implemented in this script. Misrepresenting advisory configuration as active security enforcement can cause operators to trust the system in situations where destructive actions remain unprotected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-facing confirmation messages and required reply keywords are presented in Chinese, and the prompt instructs the user to reply with Chinese options such as "确认" or "是". This creates a language/locale constraint in the skill's natural-language behavior without any visible opt-in or alternative locale handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code includes natural-language strings entirely in Chinese, including the module description and the default rollback reason, with no indication that the skill is region-specific or that users may choose another language. That creates a locale policy issue because the skill implicitly enforces a single language for interaction and logging.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains multiple natural-language strings shown to users, such as risk messages and the generated report, all written only in Chinese. Because the skill forces a specific language in user-facing output with no documented opt-in or locale selection, it violates the language/locale policy criterion.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The activation script invokes shell commands via docker exec and psql to modify a local PostgreSQL database, giving the skill direct mutation capability outside the application's normal APIs. While the current inputs are hardcoded, this design expands the attack surface and couples installation to privileged subprocess execution that could be abused if the script or environment is altered.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code executes a shell command via execSync to insert and update records in the memory database, which is a state-changing operation. While the script prints progress messages, it does not clearly disclose that running activation will modify persistent database contents or upsert existing entries.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The console log emits a Chinese-only status message ('已加载') with no alternative language or localization choice. This is a natural-language policy concern because it imposes a specific language on users without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file contains natural-language strings in Chinese and presents user-facing status/error output only in that language. Under the policy, forcing a specific language without user opt-in is a locale/language constraint that should be documented or made configurable.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- activate.js:55