Recon Quick

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This is a real bug-bounty reconnaissance skill, but it should be reviewed because it can actively scan external targets and write files with weak target and output safeguards.

Install and run this only if you are comfortable with a tool that performs active reconnaissance and port scanning. Use it only on targets you are authorized to test, prefer a restricted workspace or container, pin or review the bbot version before installing, and avoid passing untrusted target strings until the output path handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4 and SKILL.md:14
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["bbot","nmap"]},"install":[{"id":"bbot","kind":"pipx","packages":["bbot"],"label":"Install bbot via pipx"}]}}

bash

pipx install bbot

Technical Analysis

The Skill installs bbot from the configured Python package index without specifying a reviewed version or validating package integrity. Consequently, the exact code installed can change after the Skill has been audited.

Although no evidence indicates that the current bbot package is malicious, relying on an unpinned executable dependency exposes users to compromised upstream releases, unexpected breaking changes, and package-index or account compromise. The installed package is subsequently invoked by scripts/recon.py, causing its code to execute with the privileges of the user running the Skill.

Attack Path

1. An attacker compromises the upstream package publisher, release process, or configured package index.
2. The attacker publishes a malicious or backdoored version under the expected bbot package name.
3. A user installs the Skill dependency using pipx install bbot.
4. Because no version or integrity constraint is present, the malicious release is selected.
5. The payload executes during package use when the reconnaissance script invokes the installed bbot executable.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the user running the Skill. This could permit access to user-readable files, modification of user-writable files, credential theft from the user's environment, unauthorized network activity, or falsification of reconnaissance results.

The dependency does not inherently provide administrative privileges, so the immediate scope is g ...[truncated 189 chars]

Remediation

View remediation

Remediation Suggestions

• Pin bbot to a specifically reviewed version in both the Skill metadata and installation documentation.
• Use an internally approved package index or trusted mirror where possible.
• Verify package hashes or signatures when supported by the installation mechanism.
• Establish a controlled dependency-update process that includes source review, vulnerability scanning, and functional testing.
• Document the exact supported package version so the metadata and manual installation instructions remain consistent.
• Run reconnaissance tools in a restricted environment with only the filesystem and network permissions required for the scan.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recon.py:139

Finding

Unvalidated Target Allows Output Directory Path Traversal

Content

View full analysis

Vulnerability Details

File Location: scripts/recon.py:139-140
Vulnerability Type: Path traversal and arbitrary user-writable file overwrite
Risk Level: Medium

Vulnerable Code

python

outdir = os.path.join(args.output, args.target)
ensure_dir(outdir)

The resulting path is subsequently used to create or overwrite predictable files. For example:

python

subs_file = os.path.join(outdir, "subdomains.txt")

python

with open(subs_file, "w") as f:
    for s in sorted(subs):
        f.write(s + "\n")

Technical Analysis

The positional target argument is described as a target domain, but it is used directly as a filesystem path component without domain validation, separator rejection, canonicalization, or containment verification.

Python's os.path.join() does not guarantee that the resulting path remains beneath args.output. A target containing ../ components can traverse outside the configured output directory. If args.target is an absolute path, it replaces the preceding output path entirely.

ensure_dir() then creates the attacker-selected directory, and later scan functions open predictable result files such as subdomains.txt and ports.txt for writing. Opening these files with mode "w" truncates existing files. All effects remain subject to the operating-system permissions of the user running the script.

Attack Path

1. An attacker or untrusted caller supplies a crafted target containing traversal components or an absolute path, such as ../../chosen-directory or /tmp/chosen-directory.
2. os.path.join(args.output, args.target) resolves to a location outside the intended reconnaissance output root.
3. ensure_dir(outdir) creates that directory if the current user has permission.
4. The selected preset constructs predictable filenames beneath the escaped directory.
5. Operations such as open(subs_file, "w") create or truncate those files ...[truncated 743 chars]

Remediation

View remediation

Remediation Suggestions

• Validate target according to the accepted input type, such as a DNS hostname, IPv4 address, or IPv6 address.
• Reject absolute paths, path separators, . components, and .. components in any value used as a directory label.
• Keep the scan target separate from the filesystem directory name. Derive a sanitized identifier for output storage rather than using the raw target.
• Resolve the output root and destination with os.path.realpath() or pathlib.Path.resolve(), then verify that the destination remains beneath the resolved output root.
• Reject the operation if os.path.commonpath() indicates that the destination escapes the output root.
• Consider creating result files with exclusive creation where overwriting is unnecessary.
• Check for symbolic links before writing sensitive result files, particularly if the output directory can be modified by another user.
• Run the script with the minimum filesystem privileges required.

Example containment approach:

python

from pathlib import Path

output_root = Path(args.output).resolve()
safe_target = validate_and_normalize_target(args.target)
outdir = (output_root / safe_target).resolve()

if output_root not in outdir.parents:
    raise ValueError("Output path escapes the configured output directory")

outdir.mkdir(parents=True, exist_ok=True)

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs use of shell-based reconnaissance tooling that performs network scanning and writes results to disk, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a mismatch between documented capabilities and governance controls, increasing the risk that an agent can invoke shell, read files, and write outputs without clear restriction or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and usage examples normalize active reconnaissance workflows, including nmap scanning and output collection, without an explicit warning that these actions probe external systems and persist results locally. In an agent setting, this can lead to unintended or unauthorized scanning activity and silent data creation, especially if a user invokes the skill based only on its brief description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recon.py (reported line 24)May include surrounding context.

python

try:
        if output_file:
            with open(output_file, "w") as f:
                result = subprocess.run(cmd, stdout=f, stderr=subprocess.PIPE, text=True, timeout=timeout)
        else:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recon.py (reported line 26)May include surrounding context.

python

with open(output_file, "w") as f:
                result = subprocess.run(cmd, stdout=f, stderr=subprocess.PIPE, text=True, timeout=timeout)
        else:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0
    except subprocess.TimeoutExpired:
        print(f"  ⏰ Timeout: {cmd[0]}", file=sys.stderr)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill automates active reconnaissance against user-supplied targets using bbot and nmap, but it does not provide an explicit authorization or external-network-activity warning before launching scans. In an agent skill context, this increases the chance of unintended scanning of third-party systems, which can violate policy, trigger abuse complaints, or cause legal and operational issues even if technically limited.

Content

No source excerpt is available for this finding.