Security audit

Tool Master

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it can steer an agent to run broad local and OpenClaw administrative commands with weak guardrails.

Review carefully before installing. This skill should only be used where you want a Chinese keyword-to-command router and can enforce explicit user approval, previews, and scope checks before any deletion, file edit, network request, session/config access, OpenClaw admin change, service restart, or backup restore.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:33
Finding: Autonomous System and Project Monitoring Without Explicit User Authorization
Content: View full analysis
| 6 openclaw:config list | ... | openclaw config list | 6 ``` ### Technical Analysis The Skill's declared core purpose is to locate suitable utility commands through keyword matching. However, its self-driven and preventive-maintenance workflows authorize the agent to initiate periodic system or project inspection without requiring a corresponding user request. This violates least-authority principles at the instruction level. An agent following these directions may infer that it has standing permission to inspect system state, project contents, session history, or configuration data whenever it considers such inspection useful. The command map includes access to OpenClaw session history and configuration enumeration. Although these commands are not automatically executed by code in the package, combining them with the autonomous workflow creates a path for unrequested access to potentially sens ...[truncated 1228 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:120
Finding: Insufficient Confirmation Controls for Destructive and State-Changing Commands
Content: View full analysis
| 7 openclaw:backup restore | ... | openclaw backup restore | 6 ``` ### Technical Analysis The Skill explicitly requires confirmation only for examples such as `rm -rf` and `dd`. Other mutating commands are governed by the vague instruction to exercise caution. The standard workflow directs the agent to select and execute the best matching command, but it does not establish a mandatory confirmation gate based on command effects. Several mapped commands can cause destructive or disruptive changes: - `rm file.txt` deletes data. - `kill -9 PID` terminates a process immediately without allowing graceful cleanup. - `openclaw gateway stop` interrupts gateway availability. - `openclaw config set` modifies operational configuration. - `openclaw backup restore` may overwrite current state with backup contents. Because tool selection is keyword-based, an ambiguous request or incorrect match could select a command with broader effects than the user intended. The autonomous workflow increases this risk by allowing tool selection without a direct user request. No command-injection implementation was found because the package contains documentation rathe ...[truncated 1432 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The mapping begins using very broad natural-language keywords such as '列表', '查看文件', and similar generic terms that can appear in ordinary conversation. In a keyword-based invocation system, ambiguous triggers materially raise the risk of unintended activation and tool selection, especially when the catalog also contains sensitive or state-changing commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill lists destructive and state-changing commands, including file deletion and operational changes, without any warning about permanence, scope, or need for confirmation. Users and downstream agents may therefore treat these mappings as routine utilities, underestimating the risk of irreversible data loss or unintended system modification.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The rm mapping is tied to broad destructive keywords like '删除, 移除, 清理' without constraints on target, scope, or confirmation. Such generic triggers can easily overlap with benign cleanup requests and lead to selection of a destructive command, creating a direct path to data loss if the surrounding agent executes or strongly suggests the command automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The mapping includes network access, system administration, credential-adjacent setup, session/history access, configuration mutation, service lifecycle control, and backup restore operations that exceed the justified scope of a generic tool lookup helper. In a keyword-triggered skill, these capabilities can expose sensitive data or alter remote/local state with minimal friction, making accidental or abusive activation significantly more dangerous.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as a lookup system for finding suitable tools, but its workflow repeatedly instructs the agent to execute matched commands automatically and return results. This creates a capability/behavior mismatch that can cause the agent to perform shell or system actions based on loose keyword matching, increasing the risk of unsafe command execution, unintended side effects, or abuse through prompting that steers tool selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description is written as a Chinese-only instruction label and the document consistently presents the skill in Chinese, with no indication that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless it is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file's headings, descriptions, and trigger keywords are all Chinese-language only, which can amount to forcing a specific language/locale absent user opt-in. No note indicates that the skill is region-specific or that alternative language support is intentionally unavailable.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is described as a keyword-based tool lookup system, but the mapping enumerates many executable, state-changing, and administrative commands such as file deletion, process termination, service control, configuration changes, backup restore, and remote operations. This creates a capability-scope mismatch: a benign discovery feature can become an implicit action router, increasing the chance that ordinary language requests trigger powerful operations the user did not intend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill exposes commands for network requests and access to session/history/config-related data but does not disclose privacy, data handling, or trust-boundary risks. Without these warnings, users may unknowingly trigger outbound requests, access sensitive histories, or reveal configuration details that should be treated as confidential.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Network tools such as curl and wget are mapped to highly generic terms like '下载' and '获取网页', which can match many harmless information requests. In practice this can cause unexpected outbound network access, retrieval of untrusted content, or exfiltration opportunities if the selected command incorporates attacker-controlled URLs or destinations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Text-editing and file-modifying mappings use broad terms like '替换, 编辑, 修改文件', which can capture common assistance requests that do not imply direct file mutation. Because these tools can alter user data, weak trigger boundaries increase the chance of unintended modifications or unsafe command generation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Administrative OpenClaw mappings for skill management and configuration are activated by broad phrases like '安装技能', '修改配置', and '查看所有配置' without scope restrictions. These actions can change platform behavior or reveal sensitive configuration values, so loose matching substantially increases the risk of unauthorized or unintended administrative operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.