Recon Quick

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This is a real bug-bounty reconnaissance skill, but it should be reviewed because it can actively scan external targets and write files with weak target and output safeguards.

Install and run this only if you are comfortable with a tool that performs active reconnaissance and port scanning. Use it only on targets you are authorized to test, prefer a restricted workspace or container, pin or review the bbot version before installing, and avoid passing untrusted target strings until the output path handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:14` **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["bbot","nmap"]},"install":[{"id":"bbot","kind":"pipx","packages":["bbot"],"label":"Install bbot via pipx"}]}} ``` ```bash pipx install bbot ``` ### Technical Analysis The Skill installs `bbot` from the configured Python package index without specifying a reviewed version or validating package integrity. Consequently, the exact code installed can change after the Skill has been audited. Although no evidence indicates that the current `bbot` package is malicious, relying on an unpinned executable dependency exposes users to compromised upstream releases, unexpected breaking changes, and package-index or account compromise. The installed package is subsequently invoked by `scripts/recon.py`, causing its code to execute with the privileges of the user running the Skill. ### Attack Path 1. An attacker compromises the upstream package publisher, release process, or configured package index. 2. The attacker publishes a malicious or backdoored version under the expected `bbot` package name. 3. A user installs the Skill dependency using `pipx install bbot`. 4. Because no version or integrity constraint is present, the malicious release is selected. 5. The payload executes during package use when the reconnaissance script invokes the installed `bbot` executable. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the user running the Skill. This could permit access to user-readable files, modification of user-writable files, credential theft from the user's environment, unauthorized network activity, or falsification of reconnaissance results. The dependency does not inherently provide administrative privileges, so the immediate scope is g ...[truncated 189 chars]
• Remediation: ## Remediation Suggestions - Pin `bbot` to a specifically reviewed version in both the Skill metadata and installation documentation. - Use an internally approved package index or trusted mirror where possible. - Verify package hashes or signatures when supported by the installation mechanism. - Establish a controlled dependency-update process that includes source review, vulnerability scanning, and functional testing. - Document the exact supported package version so the metadata and manual installation instructions remain consistent. - Run reconnaissance tools in a restricted environment with only the filesystem and network permissions required for the scan.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recon.py:139
• Finding: Unvalidated Target Allows Output Directory Path Traversal## Vulnerability Details **File Location**: `scripts/recon.py:139-140` **Vulnerability Type**: Path traversal and arbitrary user-writable file overwrite **Risk Level**: Medium ### Vulnerable Code ```python outdir = os.path.join(args.output, args.target) ensure_dir(outdir) ``` The resulting path is subsequently used to create or overwrite predictable files. For example: ```python subs_file = os.path.join(outdir, "subdomains.txt") ``` ```python with open(subs_file, "w") as f: for s in sorted(subs): f.write(s + "\n") ``` ### Technical Analysis The positional `target` argument is described as a target domain, but it is used directly as a filesystem path component without domain validation, separator rejection, canonicalization, or containment verification. Python's `os.path.join()` does not guarantee that the resulting path remains beneath `args.output`. A target containing `../` components can traverse outside the configured output directory. If `args.target` is an absolute path, it replaces the preceding output path entirely. `ensure_dir()` then creates the attacker-selected directory, and later scan functions open predictable result files such as `subdomains.txt` and `ports.txt` for writing. Opening these files with mode `"w"` truncates existing files. All effects remain subject to the operating-system permissions of the user running the script. ### Attack Path 1. An attacker or untrusted caller supplies a crafted target containing traversal components or an absolute path, such as `../../chosen-directory` or `/tmp/chosen-directory`. 2. `os.path.join(args.output, args.target)` resolves to a location outside the intended reconnaissance output root. 3. `ensure_dir(outdir)` creates that directory if the current user has permission. 4. The selected preset constructs predictable filenames beneath the escaped directory. 5. Operations such as `open(subs_file, "w")` create or truncate those files ...[truncated 743 chars]
• Remediation: ## Remediation Suggestions - Validate `target` according to the accepted input type, such as a DNS hostname, IPv4 address, or IPv6 address. - Reject absolute paths, path separators, `.` components, and `..` components in any value used as a directory label. - Keep the scan target separate from the filesystem directory name. Derive a sanitized identifier for output storage rather than using the raw target. - Resolve the output root and destination with `os.path.realpath()` or `pathlib.Path.resolve()`, then verify that the destination remains beneath the resolved output root. - Reject the operation if `os.path.commonpath()` indicates that the destination escapes the output root. - Consider creating result files with exclusive creation where overwriting is unnecessary. - Check for symbolic links before writing sensitive result files, particularly if the output directory can be modified by another user. - Run the script with the minimum filesystem privileges required. Example containment approach: ```python from pathlib import Path output_root = Path(args.output).resolve() safe_target = validate_and_normalize_target(args.target) outdir = (output_root / safe_target).resolve() if output_root not in outdir.parents: raise ValueError("Output path escapes the configured output directory") outdir.mkdir(parents=True, exist_ok=True) ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs use of shell-based reconnaissance tooling that performs network scanning and writes results to disk, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a mismatch between documented capabilities and governance controls, increasing the risk that an agent can invoke shell, read files, and write outputs without clear restriction or user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill description and usage examples normalize active reconnaissance workflows, including nmap scanning and output collection, without an explicit warning that these actions probe external systems and persist results locally. In an agent setting, this can lead to unintended or unauthorized scanning activity and silent data creation, especially if a user invokes the skill based only on its brief description.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        if output_file:
            with open(output_file, "w") as f:
                result = subprocess.run(cmd, stdout=f, stderr=subprocess.PIPE, text=True, timeout=timeout)
        else:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(output_file, "w") as f:
                result = subprocess.run(cmd, stdout=f, stderr=subprocess.PIPE, text=True, timeout=timeout)
        else:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0
    except subprocess.TimeoutExpired:
        print(f"  ⏰ Timeout: {cmd[0]}", file=sys.stderr)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automates active reconnaissance against user-supplied targets using bbot and nmap, but it does not provide an explicit authorization or external-network-activity warning before launching scans. In an agent skill context, this increases the chance of unintended scanning of third-party systems, which can violate policy, trigger abuse complaints, or cause legal and operational issues even if technically limited.

Static analysis

No suspicious patterns detected.