ClawHub
Back to skill

Security audit

Boxed fs

Security checks for vulnerabilities and agentic risk

Overview

The skill’s file-management purpose is clear, but it tells agents to download and run an unpinned remote WebAssembly component that can modify or delete exposed files.

Review before installing. Only use this if you trust the remote WASM source and the sandbox plugin, and map only narrow directories needed for the task. Avoid exposing sensitive folders, and require explicit confirmation before write, overwrite, or remove operations.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Unverified Mutable Remote WebAssembly Payload Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-32; corroborating instructions in references/USAGE.md:7-13 and references/USAGE.md:19-37
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

SKILL.md:12-32:

js
// Download wasm first (one-time)
wasm-sandbox-download({
  url: "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/boxed-fs/files/boxed-fs-component.wasm",
  dest: "~/.openclaw/skills/boxed-fs/files/boxed-fs-component.wasm"
})

// List files
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/boxed-fs/files/boxed-fs-component.wasm",
  workDir: "~/.openclaw/workspace",
  args: ["list-dir", "--path", "."]
})

// Read file
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/boxed-fs/files/boxed-fs-component.wasm",
  workDir: "~/.openclaw/workspace",
  args: ["read-file", "--path", "example.txt"]
})

references/USAGE.md:7-13:

js
wasm-sandbox-download({
  url: "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/boxed-fs/files/boxed-fs-component.wasm",
  dest: "~/.openclaw/skills/boxed-fs/files/boxed-fs-component.wasm"
})

references/USAGE.md:29-37:

js
wasm-sandbox-run({
  wasmFile: "~/.openclaw/skills/boxed-fs/files/boxed-fs-component.wasm",
  workDir: "~/.openclaw/workspace",
  mapDirs: ["/tmp::/tmp", "/data::/data"],
  args: ["list-dir", "--path=/tmp"]
})

Technical Analysis

The Skill instructs the agent to download an executable WebAssembly component from the main branch of a personal GitHub repository and subsequently execute the downloaded file. The remote artifact is not pinned to an immutable commit or version, and the project supplies no expected cryptographic hash, digital signature, provenance attestation, or locally auditable copy.

Consequently, the executable bytes used at runtime may differ from those presen ...[truncated 2513 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle the reviewed WASM component directly in the Skill package so the audited package contains the exact executable that will run.
  2. If remote retrieval is unavoidable, use an immutable, versioned release artifact pinned to a specific commit or content-addressed location rather than a mutable branch.
  3. Publish a trusted SHA-256 or stronger digest in the Skill and verify it before every execution. Execution must fail closed when verification fails.
  4. Digitally sign the WASM artifact and validate the signature against a pinned, trusted publisher key.
  5. Provide source code and reproducible build instructions so reviewers can verify that the distributed WASM corresponds exactly to the reviewed source.
  6. Pin and document the required sandbox plugin version and verify its provenance.
  7. Apply least privilege to workDir and mapDirs. Map only the specific directory required for the current operation and avoid broad or sensitive host paths.
  8. Remove generic examples that map entire shared directories such as /tmp or /data, or clearly require explicit user approval before granting additional mappings.
  9. Store verified artifacts under immutable, version-specific filenames to prevent silent replacement after verification.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: boxed-fs
description: WebAssembly sandboxed file system operations for secure file read/write within explicitly declared directories. Use when needing to read, write, append, copy, remove, or list files in a controlled sandbox environment.
---

# boxed-fs

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation advertises destructive operations like remove-path without any warning, confirmation guidance, or mention of safety checks. In practice, this can normalize deletion actions and increase the chance that an agent invokes irreversible file removal without clear user confirmation, leading to data loss within the sandboxed workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation text says the skill triggers when the user asks to read, write, append, copy, remove, list, or otherwise manipulate files in a sandboxed environment, which is a very broad class of common requests. It does not provide specific trigger phrases, scope boundaries, or negative examples to distinguish when this skill should activate versus other file-handling tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file describes operations such as write-file, append-file, open-writable-file, copy-file, and remove-path, all of which can alter or delete user data. Although the commands are explained functionally, the document does not include any caution about overwriting files, modifying data, or irreversible deletion, which is required for markdown files describing behaviors that affect user data or system integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/USAGE.md (reported line 83)May include surrounding context.

write-file

Write file contents atomically.

js
wasm-sandbox-run({

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The file includes a Chinese-language trigger description alongside English, but does not explain whether multilingual triggering is optional, user-selected, or part of a defined locale policy. The policy requires avoiding implicit language constraints unless the skill offers language choice or clearly documents the locale behavior.

Content

No source excerpt is available for this finding.