T09 · Insecure Skill Coding Practices
Error
- Location
- manifest.json:76
- Finding
- Security Controls Are Advisory Under the Documented Host-Native Runtime<![CDATA[ ## Vulnerability Details **File Location**: `manifest.json:76-81` **Additional Locations**: `SKILL.md:157-164`, `dist/index.cjs:55-57` **Vulnerability Type**: Security sandbox fail-open configuration **Risk Level**: High ### Complete Code Snippets From `manifest.json:76-81`: ```json "sandbox": { "runtime": "nemoclaw", "fallback": "host_native", "$comment_forward_compat": "Per OpenClaw issues #28298 (permissions schema) and #28360 (sandbox boot ABI). When the runtime doesn't recognize a field, it MUST treat unknown permissions as deny — not allow. Verified on NemoClaw 0.5.0 release notes.", "$comment_runtime_decision": "Operator runtime decision 2026-05-11 (c8aba6d) shifted §3 Path (a) A.4 from NemoClaw to plain OpenClaw via `npm install -g openclaw@latest`. The `runtime: nemoclaw` field above stays as the preferred runtime claim; `fallback: host_native` is what actually runs today. Sandbox + permissions become advisory in host_native mode. Promote to NemoClaw once the homelab is willing to host the NVIDIA OpenShell + GPU stack." }, ``` From `SKILL.md:157-164`: ```markdown 1. Install plain OpenClaw + ClawHub CLI globally: ```bash npm install -g openclaw@latest clawhub openclaw --version # confirm install clawhub --version ``` (Runtime decision 2026-05-11: plain OpenClaw under `sandbox.fallback: host_native`. NemoClaw remains the preferred runtime claim in `manifest.json` for forward-compat; today's deploy targets plain OpenClaw.) ``` From `dist/index.cjs:55-57`: ```js async function runOpenClawSkill() { process.env.MUHAVEN_OPENCLAW_SKILL_VERSION = resolveSkillVersion(); await mcp.runMcpStdioCli({ filterRegistry: selectOpenClawSubsetRegistry }); } ``` ### Technical Analysis The manifest declares deny-by-default network access, no filesystem access, and no process spawning. However, the documented and currently selected deployment falls back to `host_native`, where the project explicitly acknowledges t ...[truncated 2507 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the production `host_native` fallback and fail closed when the required sandbox cannot be initialized. 2. Require a runtime that demonstrably enforces the manifest's network, filesystem, process, IPC, and telemetry restrictions before activating the skill. 3. Add a startup capability check that verifies enforcement and terminates if the runtime reports advisory-only permissions. 4. Do not describe the bin shim as providing deny-default behavior unless such controls are actually implemented and tested there. 5. Run the skill under a dedicated, unprivileged operating-system account with no access to unrelated user files. 6. Apply operating-system-level containment independently of OpenClaw, such as a container, seccomp profile, AppArmor/SELinux policy, restricted filesystem namespace, and enforceable outbound firewall rules. 7. Restrict broker IPC permissions to the dedicated runtime identity and authenticate every broker request. 8. Add integration tests that attempt prohibited filesystem reads, writes, process execution, and off-allowlist network requests. Release should fail unless every operation is blocked. 9. Clearly distinguish enforceable controls from advisory metadata in all installation and security documentation. ]]>