Workspace Maintenance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:04 PM UTC
• Version: 1.0.0

Overview

This workspace cleanup skill fits its stated purpose, but its bundled script writes to a hardcoded personal path in a way that could overwrite an unintended writable file.

Review the script before installing. Only run it after changing the archive root to your intended workspace, and consider hardening the report creation with a temporary file, symlink checks, and refusal to overwrite existing reports. The skill does not appear malicious, but its current script is too environment-specific and should be reviewed before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/archive-retention-audit.sh:4

Finding

Predictable Report Path Permits Symbolic-Link File Overwrite

Content

View full analysis

"$OUT" ``` ### Technical Analysis The script constructs a predictable daily output filename and opens it with ordinary shell truncation redirection. Shell redirection follows symbolic links and truncates the resolved target before executing `echo`. An attacker who can write to the configured archive directory can pre-create `DELETE-DRYRUN-YYYY-MM-DD.txt` as a symbolic link to another file writable by the account running the script. When the audit runs, line 7 follows that link and truncates the target before writing the report header. Subsequent append operations can add further report content to the target. The hardcoded user-specific root path also reduces portability and increases the possibility that the script operates on an unintended location. It does not, by itself, increase privileges. ### Attack Path 1. The attacker obtains write access to `/Users/ineluxx/.openclaw/workspace/docs/archive`. 2. The attacker determines the current date and predicts the output name, such as `DELETE-DRYRUN-2026-09-10.txt`. 3. The attacker creates that path as a symbolic link to a file writable by the user expected to execute the Skill. 4. The user or Agent runs `scripts/archive-retention-audit.sh`. 5. The `>` redirection follows the symbolic link and truncates the linked target. 6. The script writes the generated report content into that target. Exploitation requires the attacker to be able to create entries in the archive directory, and the target must be writable by the account executing the script. ### Impact Assessment The vulnerability permits truncation and modificatio ...[truncated 445 chars]

Remediation

View remediation

&2 exit 1 } OUT="$ROOT/DELETE-DRYRUN-$(date +%F).txt" [[ ! -L "$OUT" ]] || { echo "Refusing symbolic-link output path" >&2 exit 1 } umask 077 TMP="$(mktemp "$ROOT/.DELETE-DRYRUN.XXXXXX")" trap 'rm -f -- "$TMP"' EXIT { echo "# Dry-run deletion candidates (NO DELETE EXECUTED)" echo "# Generated: $(date '+%F %T %Z')" # Generate the remaining report content here. } > "$TMP" mv -- "$TMP" "$OUT" trap - EXIT ``` Where concurrent or adversarial directory access is possible, the directory should additionally be owned by the expected user and not writable by untrusted users. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.