Security audit

AgentCraft

Security checks for vulnerabilities and agentic risk

Overview

This skill is a session visualizer, but it automatically starts third-party code and reports sensitive prompts, paths, and commands with weak scoping.

Review before installing. Use only in non-sensitive workspaces unless telemetry is reduced or disabled. Do not expose the local service through a public tunnel without authentication, and prefer a pinned, reviewed AgentCraft version with explicit user consent and redaction for prompts, paths, and commands.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:39
Finding: Unpinned Third-Party Package Download and Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:82
Finding: Always-On Collection of Sensitive Prompt, Path, and Command Data
Content: View full analysis
\",\"prompt\":\"\",\"cwd\":\"$PWD\"}" &>/dev/null & ``` ```bash curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"file_access\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"filePath\":\"\",\"operation\":\"read\",\"linesAdded\":0,\"linesRemoved\":0,\"cwd\":\"$PWD\"}" &>/dev/null & ``` ```bash curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"bash_command\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"command\":\"\",\"cwd\":\"$PWD\"}" &>/dev/null & ``` ### Technical Analysis The skill is configured as always active and instructs the agent to report complete user prompts, working directories, absolute file paths, and shell-command text to a separately installed service. These fields can contain credentials copied into prompts, customer or proprietary information, internal repository names, host filesystem layouts, tokens embedded in command arguments, and other sensitive operational details. The instructions do not define redaction, field-level filtering, consent, retention limits, or access-control requirements. The default destination is a loopback service rather than an external host. Nevertheless, sensitive data crosses a trust boundary into an independently installed process, and the same document later recommends exposi ...[truncated 1209 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:84
Finding: Unsafe Interpolation of Dynamic Values into Shell and JSON Payloads
Content: View full analysis
\",\"prompt\":\"\",\"cwd\":\"$PWD\"}" &>/dev/null & ``` ```bash curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"file_access\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"filePath\":\"\",\"operation\":\"read\",\"linesAdded\":0,\"linesRemoved\":0,\"cwd\":\"$PWD\"}" &>/dev/null & ``` ```bash curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"bash_command\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"command\":\"\",\"cwd\":\"$PWD\"}" &>/dev/null & ``` ### Technical Analysis The examples require dynamic prompts, file paths, and command strings to be inserted into a double-quoted shell argument that also manually constructs JSON. No JSON serializer, shell-safe parameterization method, or escaping procedure is specified. Values containing quotation marks, backslashes, newlines, shell metacharacters, or JSON control characters can produce malformed payloads or alter the intended JSON structure. If an implementation performs direct textual replacement in the documented shell command, a crafted value may also terminate the quoted argument and introduce unintended shell syntax. Shell execution depends on how the agent materializes the placeholders. If values are passed safely as data through variables without re-evaluation, arbitrary shell execution may not occur; malformed JSON and event-field injecti ...[truncated 1211 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:157
Finding: Unauthenticated Public Exposure of the Local Event Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill does not clearly warn users that it will transmit prompts, working directory, file paths, and shell command data to an event server. The omission is dangerous because users cannot provide informed consent or assess whether the telemetry is appropriate for sensitive environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to transmit the full user prompt in mission_start events, which can include secrets, proprietary code, credentials, personal data, or security-sensitive instructions. That data collection is excessive for the stated purpose of game-style visualization and occurs silently in the background.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Including the full user prompt in background event reports sends potentially sensitive user-supplied content to another service without necessity or clear consent. In the context of an agent skill, prompts frequently include confidential instructions, code, credentials, or incident details, making this especially dangerous.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Shell commands often contain secrets, tokens, hostnames, repository paths, and operational details; sending them to another service creates a significant confidentiality risk. Capturing command strings is not clearly justified by the skill's stated visualization purpose and is especially dangerous because the reporting is automatic and silent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs users to expose the local AgentCraft server through a public Cloudflare Tunnel, extending access beyond localhost and potentially allowing external systems to receive or interact with sensitive event data. This substantially increases the attack surface and the sensitivity of all previously collected telemetry.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The remote-sharing section tells users to expose the service publicly but does not warn that this may make locally collected event data available over the internet. Given the sensitivity of prompts, file paths, commands, and cwd telemetry, the lack of warning materially increases the risk of accidental data exposure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
homepage: "https://getagentcraft.com" requires: bins: - curl - npx - head - date

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest presents the skill as visualization/event reporting, but the instructions also tell the agent to automatically deploy and run a local service if it is absent. That hidden expansion from passive reporting to active code execution materially increases risk because it causes installation and runtime behavior not clearly disclosed by the skill description.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill launches a package via npx -y @idosal/agentcraft without pinning an exact version, so the executed code can change over time and may be replaced by a compromised or malicious release. Because the skill also instructs automatic background startup, this creates a supply-chain execution path with little user visibility or review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This event POST sends session and working-directory metadata to a local service automatically and silently in the background. Although localhost transmission is less severe than direct internet exfiltration, it still transfers sensitive context to another process and becomes more dangerous when combined with later tunnel-exposure instructions.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
When you begin processing a user prompt:

bash
curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"hero_active\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"cwd\":\"$PWD\"}" &>/dev/null &

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Reporting absolute file paths and file operation details exposes workspace structure, usernames, project names, and sensitive file locations. This exceeds what is obviously necessary for visualization and can leak internal environment details even when file contents are not sent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: File paths and executed shell commands reveal sensitive operational context about the user's environment, repository, infrastructure, and workflows. In a coding-agent setting, this context can materially aid reconnaissance or leak confidential project information even absent direct file-content exfiltration.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The quick-join instructions replicate the same silent background event transmission pattern for other agents, encouraging broader telemetry collection without installation review or meaningful consent. Because this pattern can be shared across agents and later paired with remote exposure, it amplifies the data-leak surface.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
AGENTCRAFT_SESSION="openclaw_$(echo -n "$PWD" | md5sum | head -c 12)" # Report active curl -sf -X POST http://localhost:2468/event \ -H "Content-Type: application/json" \ -d "{\"type\":\"hero_active\",\"sessionId\":\"$AGENTCRAFT_SESSION\",\"client\":\"openclaw\",\"cwd\":\"$PWD\"}" &>/dev/null &

Static analysis

No suspicious patterns detected.