Self Defense Fundamentals

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

The skill is mostly ordinary self-defense guidance, but it asks for filesystem access it does not need and uses an unpinned npx install command.

Review before installing. The self-defense content itself is coherent, but the skill should not need filesystem access, and the installer command should ideally use a pinned, verified ClawHub CLI version. Install only in an environment where unnecessary file access is denied or tightly scoped.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10
• Finding: Unnecessary Filesystem Permission Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–13 **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium ### Vulnerable Code ```yaml openclaw: requires: tools: [filesystem] install: "npx clawhub install self-defense-fundamentals" ``` ### Technical Analysis The skill declares the `filesystem` tool as a requirement, but none of its documented self-defense workflows require reading, creating, modifying, or deleting files. The remaining content consists entirely of conversational guidance, state fields, and automation triggers. Granting filesystem access beyond the skill's legitimate functional requirements violates the principle of least privilege. The exact exposure depends on how the host scopes the filesystem tool. If it permits broad access, a loaded skill could potentially access project files, user documents, configuration files, credentials, or other sensitive local data. The audited file does not contain instructions that actively exploit this permission. The vulnerability is the unnecessary capability declaration and the resulting increase in attack surface. ### Attack Path 1. A user installs or activates the skill. 2. The host processes `openclaw.requires.tools` and grants the declared filesystem capability. 3. The skill receives filesystem access despite having no legitimate workflow that requires it. 4. If the skill instructions, package content, or execution context are later compromised, the unnecessary capability may be used to inspect or alter files within the tool's permitted scope. ### Impact Assessment A successful abuse could expose the confidentiality or integrity of files available through the filesystem tool. Potential impact includes reading sensitive local data, modifying project content, or damaging user files. No privilege beyond the filesystem tool's host-defined scope is established by the audited content, and no active filesystem abuse was found. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `filesystem` from `openclaw.requires.tools`, because the documented functionality does not use it. - Apply deny-by-default tool permissions and grant capabilities only when a concrete workflow requires them. - If future functionality requires persistence, use a narrowly scoped state API or a dedicated skill-specific directory rather than general filesystem access. - Restrict filesystem operations to an explicit allowlisted directory and prohibit access to credentials, home directories, system configuration, and unrelated project files. - Add automated manifest validation that flags declared tools not referenced by any documented or implemented workflow. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Package Execution Through npx Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: Mutable and unverified installer dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: "npx clawhub install self-defense-fundamentals" ``` ### Technical Analysis The installation command invokes `clawhub` through `npx` without specifying a package version, integrity hash, lockfile, or trusted registry. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the currently resolved package from a package registry. Because the resolved executable is mutable after this skill has been reviewed, the effective installation behavior is not fully represented by the audited repository. Compromise of the upstream package, publisher account, registry resolution, or transitive dependency chain could introduce arbitrary code into the installation process. No evidence shows that the current `clawhub` package is malicious. The confirmed issue is that the command permits execution of an unpinned and unverified third-party package. ### Attack Path 1. An attacker compromises the package publisher, an upstream dependency, or the package-resolution channel. 2. The attacker publishes a malicious version that satisfies the unpinned package reference. 3. A user runs or follows the documented `npx clawhub install self-defense-fundamentals` command. 4. `npx` downloads or resolves the attacker-controlled package version. 5. The package executes with the privileges of the user running the installation command. 6. The malicious package may then access files, environment variables, network resources, or other resources available to that user. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the installing user's account. The reachable scope may include user-owned files, project repositories, environment variables, developer credentials, and network-accessible services available from the host. ...[truncated 162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installer CLI to a specifically reviewed version, for example by using an exact package version rather than an unqualified package name. - Configure an explicit trusted registry and avoid relying on user-controlled or ambient npm registry settings. - Verify package integrity using a published cryptographic digest or signature before execution. - Prefer a preinstalled, platform-managed CLI whose provenance and update process are controlled by the host. - Use a lockfile and review the complete transitive dependency graph where package-based installation is unavoidable. - Run installation in a sandbox with minimal filesystem, environment-variable, and network access. - Never recommend executing the installer with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill includes an install command using `npx clawhub` without pinning an exact package version. This creates a supply-chain risk because a future malicious or compromised release could be fetched and executed at install time, and `npx` commonly runs package code immediately.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

## Rules

- Always present the hierarchy (awareness -> avoidance -> de-escalation -> physical response -> escape) — never skip straight to fighting techniques
- Always recommend giving up property rather than fighting to protect it
- Self-defense law varies by jurisdiction — never give specific legal advice; always recommend consulting a local attorney
- Physical techniques are for creating space to escape, not for winning fights
- If someone describes symptoms of an ongoing threat situation, direct them to appropriate crisis resources immediately

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Self-defense law varies by jurisdiction — never give specific legal advice; always recommend consulting a local attorney
- Physical techniques are for creating space to escape, not for winning fights
- If someone describes symptoms of an ongoing threat situation, direct them to appropriate crisis resources immediately
- Never recommend weapons without checking local legality first
- Adapt all advice to the user's physical capabilities and limitations

## Tips

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.