ClawHub
Back to skill

Security audit

OpenGemini CLI

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent Gemini CLI helper, with the main caveat that selected prompts and file contents may be sent to Gemini.

Before installing, make sure you are comfortable with OpenClaw using the local Gemini CLI and potentially sending prompts or selected file contents to Gemini. Use it for bounded reviews and generation, and do not run it on secret, credential, private, or proprietary files unless sharing that content with Gemini is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script reads the entire local file and embeds its contents directly into a prompt sent to the external gemini CLI, with no confirmation, redaction, scope restriction, or explicit disclosure to the user at execution time. In this skill's context, that is materially risky because the stated purpose is to use a secondary model on arbitrary local files, making accidental exfiltration of secrets, proprietary code, credentials, or personal data more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The sample prompts explicitly require Japanese content for website copy and a Japanese marketing service, which imposes a specific language/locale in the skill guidance. The file does not state that this skill is only for Japanese-market work or that language should be chosen based on user preference, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.