T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run-mission-control-visual-qa.sh:8- Finding
Remote Command Injection Through Unvalidated Directory Environment Variables
- Content
View full analysis
- Remediation
View remediation
Security audit
mission-control-visual-qa
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it runs commands on a remote machine and opens user-supplied URLs without enough guardrails.
Install only if you trust the operator and will run it against a tightly controlled SSH target. Use a dedicated low-privilege remote account, keep OUTPUT_DIR and REMOTE_RUN_DIR fixed to safe paths, avoid attacker-controlled URLs, and restrict the runner to approved Mission Control hosts before using it on sensitive environments.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mission-control-visual-qa.js:25- Finding
Unrestricted URL Navigation in an Unsandboxed Chromium Process
- Content
View full analysis
[url2 ...]'); process.exit(2); } const outputDir = process.env.OUTPUT_DIR || path.join(os.homedir(), '.openclaw/workspace/output/visual-qa'); fs.mkdirSync(outputDir, { recursive: true }); let puppeteer; try { puppeteer = require('puppeteer'); } catch (err) { console.error('Missing dependency: puppeteer. Install on REMOTE host.'); console.error(err.message); process.exit(3); } const browser = await puppeteer.launch({ headless: true, executablePath: process.env.CHROMIUM_PATH || '/usr/bin/chromium', args: ['--no-sandbox', '--disable-setuid-sandbox'], }); ``` ```javascript for (const url of urls) { const page = await browser.newPage(); await page.setViewport({ width: 1440, height: 900 }); const item = { url, ok: false, checks: {}, }; try { await page.goto(url, { waitUntil: 'networkidle2', timeout: 45000 }); ``` ### Technical Analysis Every command-line value is passed to `page.goto()` without validation of its scheme, hostname, resolved address, port, or redirect destination. Although the documentation describes the tool as a Mission Control QA utility, the implementation does not enforce that scope. Depending on Chromium's supported navigation behavior and the remote host's network access, supplied URLs can target loopback services, private-network systems, link-local endpoints, cloud metadata services, or local resources. HTTP redirects are also not checked, so an initially approved-looking URL could redirect the browser to a prohibited destination. The browser is simultaneously launche ...[truncated 2848 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/mission-control-visual-qa.js`: Puppeteer-based remote runner (intended to run on REMOTE).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/run-mission-control-visual-qa.sh`: Local helper that copies and runs the Node script over `scp` + `ssh`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/run-mission-control-visual-qa.sh`: Local helper that copies and runs the Node script over `scp` + `ssh`.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares operational behavior involving environment variables (
SSH_TARGET,REMOTE_RUN_DIR,OUTPUT_DIR) and remote execution over SSH/SCP, but it does not define any explicit tool scope or permission boundaries. This creates a trust gap where an agent or user may invoke capabilities affecting local environment and remote systems without clear, machine-readable restrictions, increasing the chance of unintended command execution against the wrong host or path.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script navigates a headless browser to arbitrary user-supplied URLs, which causes outbound network requests and page execution without any guardrails, warnings, or allowlisting. In this skill context, that can expose the host's network position, trigger requests to internal services or sensitive endpoints, and execute untrusted page content in Chromium during QA runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script saves full-page screenshots of visited pages to disk automatically, with no warning, minimization, or redaction. In a visual QA skill, screenshots can capture sensitive application data, secrets, internal dashboards, and user content, leaving potentially persistent artifacts in a predictable workspace directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script creates directories on a remote host via SSH and copies a local script to that host via SCP, which are safety-relevant operations affecting remote system state. Aside from the usage line, there is no confirmation prompt, user-facing disclosure, or explanatory comment warning that the script will connect to a remote machine and modify files there.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This line executes a Node.js script on the remote host over SSH using user-supplied URL arguments, which is a subprocess/shell execution on another system. The file does not include any visible warning, confirmation, or descriptive comment telling the user that arbitrary remote execution will occur as part of running this wrapper.
- Content
Static analysis
No suspicious patterns detected.