Background Download

• Outcome: Review
• Latest audit: May 28, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it gives caller-controlled downloads too much local execution and file-writing power without enough safeguards.

Review before installing. Use only with trusted callers and non-sensitive URLs until it is hardened to avoid shell=True, constrain downloads to an approved directory, validate URL schemes and notification channels, redact URLs/paths in messages, and provide a way to cancel or clean up background tasks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_ontology_cmd(cmd):
    """Run ontology command and return parsed JSON"""
    full_cmd = f"python3 {ONTOLOGY_SCRIPT} {cmd}"
    result = subprocess.run(full_cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Ontology command failed: {full_cmd}\n{result.stderr}", file=sys.stderr)
        return None

• Confidence: 99% confidence
• Finding: The code builds a shell command from a caller-controlled string and executes it with shell=True. Because create/query/update arguments ultimately embed untrusted fields such as title, url, path, and channel into cmd, an attacker can inject shell metacharacters and execute arbitrary commands in the context of the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

channel_type = parts[0]
    target = ":".join(parts[1:])
    cmd = f"openclaw message send --channel {channel_type} --target {target} --message '{message}'"
    result = subprocess.run(cmd, shell=True)
    return result.returncode == 0

def do_download(task):

• Confidence: 98% confidence
• Finding: The notification command interpolates channel_type, target, and message into a shell command and executes it with shell=True. Since channel and message content can contain quotes or shell metacharacters, this enables command injection and can also be used to redirect notifications or run arbitrary local commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Use curl with resume
    cmd = f"curl -C - -L -o '{path}' '{url}'"
    print(f"Running: {cmd}")
    result = subprocess.run(cmd, shell=True)
    return result.returncode == 0

def background_download(task_id):

• Confidence: 99% confidence
• Finding: The download routine constructs a curl shell command using untrusted path and url values and runs it with shell=True. A crafted path or URL containing quotes and shell syntax can break out of the quoted arguments and lead to arbitrary command execution, while also allowing writes to attacker-chosen filesystem locations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly documents shell-backed behavior such as invoking Python scripts and relying on external download utilities, yet the manifest does not declare any corresponding execution permissions. This capability mismatch weakens policy enforcement and user/operator awareness, making it easier for a seemingly limited skill to execute broader system actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest claims only Ontology reads/writes for `DownloadTask`, but the skill also sends outbound notifications to user channels via an external messaging command. Undeclared external communication is dangerous because it expands the data-flow and trust boundary beyond what reviewers and policy systems are told, enabling covert or unauthorized message delivery.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Depending on `curl` or `wget` means the skill can spawn external processes that perform arbitrary outbound network access and write files to local paths, which is materially broader than a simple ontology-tracking helper. In the context of a background downloader, this increases risk because untrusted URLs and paths could lead to SSRF-style access, retrieval of malicious payloads, or writes to sensitive filesystem locations if not tightly constrained.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill writes downloaded content to any caller-supplied path with no restriction or confirmation. In this context, that is dangerous because the tool runs in the background and can overwrite sensitive files, place executables or scripts in startup locations, or persist untrusted content outside an expected download directory.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The code sends file paths and failed download URLs to an external messaging channel without minimizing or redacting sensitive data. In practice, URLs often contain tokens, internal hostnames, query secrets, or personal information, so notifications can leak data to unintended recipients if channels are misconfigured or attacker-controlled.

Static analysis

No suspicious patterns detected.