Security audit

Openclaw Skill Qa Quickcheck

Security checks for vulnerabilities and agentic risk

Overview

This QA testing skill is mostly coherent, but it gives agents broad automatic testing power that can run project code, probe sensitive endpoints, and execute unsafe test templates without enough user control.

Use this only on repositories and services you control, preferably in an isolated test environment with minimal environment variables. Review and approve the exact startup commands, target URLs, generated configs, and any template files before running Standard mode; avoid production targets, untrusted templates, and unpinned package downloads.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/data-factory.js:193
Finding: Arbitrary JavaScript Execution Through Data Templates
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/http-test-runner.js:102
Finding: Environment Variables Can Be Exfiltrated Through Configurable HTTP Requests
Content: View full analysis
{ const r = (Math.random() * 16) | 0; const v = c === "x" ? r : (r & 0x3) | 0x8; return v.toString(16); }); } return value; } function resolveObject(obj) { if (typeof obj === "string") return resolveValue(obj); if (Array.isArray(obj)) return obj.map(resolveObject); if (typeof obj === "object" && obj !== null) { const result = {}; for (const [key, value] of Object.entries(obj)) { result[key] = resolveObject(value); } return result; } return obj; } ``` The resolved values are subsequently placed into attacker-controlled requests: ```js const resolved = resolveObject(testCase); const url = new URL(resolved.path || "/", config.baseUrl); if (resolved.query) { Object.entries(resolved.query).forEach(([k, v]) => { url.searchParams.set(k, String(v)); }); } const resolvedHeaders = resolved.headers || {}; const body = resolved.body ? typeof resolve ...[truncated 1995 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/security-headers-check.js:21
Finding: Unrestricted SSRF and Automatic Enumeration of Sensitive Internal Endpoints
Content: View full analysis
p.trim()), timeout: parseInt(args["--timeout"] || "10000", 10), }; if (!config.targetUrl) { process.exit(1); } const parsedUrl = new URL(config.targetUrl); const client = parsedUrl.protocol === "https:" ? https : http; ``` ```js function checkUrl(path) { return new Promise((resolve) => { const url = `${parsedUrl.origin}${path}`; const req = client.request( url, { method: "GET", timeout: config.timeout }, (res) => { let data = ""; res.on("data", (chunk) => (data += chunk)); res.on("end", () => { resolve({ path, url, status: res.statusCode, headers: res.headers, body: data.substring(0, 1000), }); }); } ); req.on("timeout", () => { req.destroy(); resolve({ path, url, status: 0, headers: {}, body: "", error: "request timed out" }); }); req.on("error", (err) => { resolve({ path, url, status: 0, headers: {}, body: "", error: err.message }); }); req.end(); }); } ``` ```js const allPaths = [ ...config.paths, "/admin", "/debug", "/swagger", "/swagger-ui.html", "/api-docs", "/actuator", "/graphql", "/.env", "/phpinfo.php", "/console", "/metrics", "/health", ]; const results = []; for (const path of allPaths) { const result = await checkUrl(path); results.push(result); } ``` ### Technical Analysis The checker accepts any caller-provided HTTP or HTTPS URL and performs requests from the Skill host. It does not reject loopback, private, link-local, metadata, multicast, or otherwise privileged network ranges. It a ...[truncated 1754 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/01-静态代码审计.md:213
Finding: Audit Workflow Recommends Execution of Unpinned Registry Packages
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/02-动态功能测试.md:29
Finding: Standard Mode Automatically Executes Target-Repository Startup Commands
Content: View full analysis
start > serve > build ``` The documented examples include: ```text npm run dev npm start python main.py flask run uvicorn main:app --reload mvn spring-boot:run gradle bootRun go run main.go cargo run bundle exec rails server php artisan serve dotnet run ``` The workflow also directs the Agent to retry startup failures and try alternate ports. ### Technical Analysis Build and startup definitions are executable repository content. For example, a `package.json` script can invoke arbitrary shell commands, and equivalent build hooks exist in Maven, Gradle, Python, Ruby, PHP, Rust, and other supported ecosystems. The Skill treats project startup as a mandatory Standard-mode operation but does not require: - Review of the exact command before execution. - User confirmation. - A trusted-repository determination. - Container or virtual-machine isolation. - Removal of host credentials from the environment. - Filesystem or outbound-network restrictions. - Prevention of dependency lifecycle scripts. Consequently, auditing an untrusted repository can cause repository-controlled code to run before the audit has established that the project is safe. ### Attack Path 1. An attacker supplies a repository for review. 2. The repository defines a malicious `dev`, `start`, `serve`, build, framework-startup, or equivalent command. 3. The user invokes Standard mode. 4. The Agent identifies the project technology and automatically selects the documented startup command. 5. The malicious command executes with the Agent's oper ...[truncated 707 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the underlying implementation probes sensitive paths such as /admin, /.env, /debug, or /swagger while presenting itself as a general testing helper, that is a significant behavior mismatch. Undisclosed active enumeration can trigger security controls, access unintended endpoints, or scan internal services in ways the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: If the underlying implementation probes sensitive paths such as /admin, /.env, /debug, or /swagger while presenting itself as a general testing helper, that is a significant behavior mismatch. Undisclosed active enumeration can trigger security controls, access unintended endpoints, or scan internal services in ways the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the underlying implementation probes sensitive paths such as /admin, /.env, /debug, or /swagger while presenting itself as a general testing helper, that is a significant behavior mismatch. Undisclosed active enumeration can trigger security controls, access unintended endpoints, or scan internal services in ways the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
| HTTP 测试跑器 | `scripts/http-test-runner.js` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
| 配置检查脚本 | `scripts/security-headers-check.js` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
| 测试数据工厂 | `scripts/data-factory.js` |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/01-静态代码审计.md (reported line 386)May include surrounding context.
md
| 技术栈 | 依赖文件 | Lock 文件 | 配置文件 | |:---|:---|:---|:---| | Node.js | `package.json` | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | `.npmrc` | | Python | `requirements.txt` / `pyproject.toml` | `poetry.lock` / `Pipfile.lock` | `pip.conf` | | Java/Maven | `pom.xml` | 无（依赖在本地仓库） | `.m2/settings.xml` | | Java/Gradle | `build.gradle` | `gradle.lockfile` | `gradle.properties` |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section provides explicit attack payloads and token tampering instructions, but the safety warning is fragmented and not enforced by a strong upfront gate. If the environment is misclassified or the instructions are reused out of context, the agent could perform active exploitation attempts against live systems, causing service disruption, data exposure, or unauthorized access attempts.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/02-动态功能测试.md (reported line 212)May include surrounding context.
md
- SQL 注入：`' OR '1'='1`、`'; DROP TABLE users; --` - NoSQL 注入：`{"$gt": ""}`、`{"$ne": null}` - XSS 探测：`<script>alert(1)</script>`、`<img src=x onerror=alert(1)>` - 命令注入：`; ls`、`| cat /etc/passwd` - 模板注入：`${{7*7}}`、`{{constructor.constructor('return this')()}}` **重要**：每个 Payload 发送后，记录响应状态码和响应体截断。重点是观察是否有异常响应（如返回了不应该返回的数据、SQL 错误信息等）。

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The $custom feature evaluates template-supplied JavaScript using new Function, which allows arbitrary code execution in the context of the Node.js process. Because the template file is external input, an attacker or untrusted contributor can execute system commands, read files, access environment variables, or perform network activity, far beyond test data generation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 77% confidence
Finding: The script explicitly probes high-risk paths such as /.env, which commonly contain secrets if misconfigured. Even though the request is read-only and intended for validation, automatically attempting to access secret-bearing files increases the chance of unauthorized secret discovery against the wrong target and expands the skill from QA into sensitive reconnaissance.
Content: Scanner excerpt · scripts/security-headers-check.js (reported line 233)May include surrounding context.
js
"/api-docs", "/actuator", "/graphql", "/.env", "/phpinfo", "/console", "/metrics",

Credential Access

High

Category: Privilege Escalation
Confidence: 77% confidence
Finding: The main scan path list again includes /.env, causing the tool to request a file that may expose credentials or application secrets if publicly reachable. In the context of a broadly described QA assistant, this capability is more dangerous because users may run it outside a formally authorized security assessment scope.
Content: Scanner excerpt · scripts/security-headers-check.js (reported line 273)May include surrounding context.
js
"/api-docs", "/actuator", "/graphql", "/.env", "/phpinfo.php", "/console", "/metrics",

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description and example invocations are entirely in Chinese, including the required trigger phrases 按 Quick 测试 and 按 Standard 测试. This implies a fixed language requirement for use, but the README does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill defines operational behavior that implies access to environment capabilities but does not declare an explicit tool or permission scope. This creates ambiguity about what the agent may access at runtime and weakens least-privilege controls, increasing the chance of unintended data exposure or broader execution than users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary developer conversation such as '测试', '代码审查', or 'PR 检查'. This raises the risk of accidental activation of a skill that may run scans, load references, or produce outputs without clear user intent, especially problematic for a tool that may perform dynamic testing or write reports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown instructs the agent to generate test-report.md in the project root, contradicting the stated '只读不写' expectation elsewhere in the skill. Undisclosed local writes can overwrite files, create noisy repo changes, or leak sensitive findings into tracked directories without the user's explicit consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description is presented only in Chinese, which can impose a language preference on users without any opt-in or alternative locale. Under the policy rule, language-specific behavior or presentation should either offer a choice or clearly justify the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown appendix is written entirely in Chinese and includes an imperative role statement directing behavior, but it does not offer any language or locale choice. The policy for this audit flags natural-language constraints that force a specific language without user opt-in unless the locale limitation is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file instructs the agent to always generate test-report.md in the project root, which is a workspace write operation. Because the skill does not clearly warn the user that it will modify repository files or require confirmation before writing, it can cause unexpected file creation or overwriting, pollute commits, or interfere with existing project artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and all operational instructions are written entirely in Chinese, establishing the skill's required working language implicitly. There is no natural-language indication that users may choose another language or locale, nor any justification that this is a region-specific skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L008 明确将本文件范围限定为源码、配置和命令行审计，且不要求项目可运行。但后文在 L303-L318 指示 AI 推断启动命令、启动项目并在失败时尝试备用端口，这已经超出纯静态审计范围，和文件自身描述不一致。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.