Security audit

My Shell

Security checks for vulnerabilities and agentic risk

Overview

This skill is a raw shell runner with weak command controls and a malformed metadata file that contains an unexpected shell overwrite command.

Install only if you intentionally want broad local shell execution from this skill and can run it in a tightly limited environment. The package should be fixed before general use: make metadata valid JSON, remove the heredoc overwrite command, replace shell-string execSync calls with argument-array execution, and add a real approval or sandbox boundary for dangerous commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: handler.js:11
Finding: Host Shell Command Injection Through Unsafe tmux Invocation
Content: View full analysis
/tmp/claw-host-execution)" } ``` 2. `isDangerous` does not identify this payload as prohibited. 3. `sendCommand` places the input inside a double-quoted shell command. 4. The host shell evaluates `$(id > /tmp/claw-host-execution)` before invoking tmux. 5. The injected command runs directly under the account hosting the skill, outside the intended tmux execution context. 6. The attacker can replace `id` with other commands available to that account to access files, invoke local programs, or modify user-owned resources. ### Impact Assessment Successful exploitation provides arbitrary command execution with the operating-system privileges of the Node.js skill process. The attacker can read or modify files accessible to that account, access environment-dependent secrets, execute installed tools, and al ...[truncated 249 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: handler.js:24
Finding: Dangerous-Command Denylist Can Be Bypassed
Content: View full analysis
lower.includes(k)); } // MAIN ENTRYPOINT // OpenClaw will call this function when using the skill tool async function claw_shell_run(input) { const { command } = input; if (!command || typeof command !== "string") { return { error: "command is required" }; } if (isDangerous(command)) { return { error: "dangerous_command", message: `Command looks dangerous. Ask the user for explicit approval before running: ${command}` }; } ``` ### Technical Analysis The safety control uses substring matching against a short denylist. This does not parse shell syntax and cannot reliably determine which executable will ultimately run. The control can be bypassed through absolute or relative executable paths, shell expansions, aliases, interpreters, alternate utilities, spacing variations, or commands absent from the list. For example, the filter looks for the exact substring `" rm "`, but an absolute executable path such as `/bin/rm` does not contain that substring. The implementation also has no trusted approval token or persisted authorization state. Although the returned message tells the caller to request explicit approval, an approved command would still be rejected if submitted unchanged. Conversely, a syntactically modified command can evade the filter without approval. ### Attack Path 1. The attacker supplies a destructive command using an absolute path, for example: ```json { "command": "/bin/rm -rf /tmp/target-directory" } ``` 2. The padded lowercase input is `" /bin/rm -rf /tmp/target-directory "`. 3. It does not contain the denylist en ...[truncated 970 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: _meta.json:27
Finding: Metadata File Contains Executable Shell Commands and Is Not Valid JSON
Content: View full analysis
~/.openclaw/skills/claw-shell/_meta.json << 'EOF' { "owner": "gdwebw", "slug": "my-shell", "displayName": "my-shell", "latest": { "version": "1.0.0", "publishedAt": 1769948954608 }, "history": [] } EOF ``` ### Technical Analysis The file is named `_meta.json`, but its contents include comments and an unquoted shell command with a heredoc. It is therefore not valid JSON. The shell fragment writes new metadata to `~/.openclaw/skills/claw-shell/_meta.json`, replacing the file with owner and slug values that differ from the earlier commented metadata. A strict metadata parser will reject the current file. If a user, installer, or automation system mistakenly treats it as a shell script, it will overwrite local skill metadata. No automatic execution path for this fragment was identified in the audited files. Consequently, this is a packaging and unsafe-configuration issue rather than confirmed persistence or confirmed malicious-code execution. ### Attack Path 1. A user or installation process assumes `_meta.json` contains setup instructions or otherwise passes it to a shell. 2. The shell executes the `cat` heredoc. 3. The installed metadata file under the user's home directory is overwritten. 4. Subsequent tooling reads the replacement owner, slug, and display name, potentially causing attribution errors or inconsistent package state. Under normal strict JSON parsing, the more immediate outcome is a parsing failure rather than command execution. ### Impact Assessment Likely impacts include metadata parser failure, installation or update errors, inconsistent package identity, and incorrect attribution. If the file is accidentally executed, it modifies the current user's OpenClaw skill metadata. The observed command does not ...[truncated 170 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This is a true vulnerability: a file presented as static metadata contains shell redirection commands that write to ~/.openclaw/skills/claw-shell/_meta.json and replace the manifest with different owner/slug values. Embedding executable shell content in a metadata file is deceptive and dangerous because any tooling or user that copies, templates, or executes the content could silently overwrite another skill's manifest and tamper with installed skill identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill executes arbitrary user-supplied shell commands by injecting them into a persistent tmux session with no built-in confirmation, allowlist, or meaningful sandboxing. The lightweight substring-based 'dangerous' filter is easily bypassed and misses many destructive or exfiltration-capable commands, so an attacker or unsafe prompt flow could run arbitrary code on the host.
Content: No source excerpt is available for this finding.