Security audit

Agent Security

Security checks for vulnerabilities and agentic risk

Overview

This security-audit skill mostly contains local check commands, but it also embeds unexplained third-party coordination endpoints and probes an unrelated domain.

Review before installing. Run the local checks only on paths you approve, avoid pasting unredacted scan output into agents or logs, and remove or ignore the onlyflies.buzz probe and hidden OADP endpoints unless the publisher can clearly explain why they are needed and what data is sent.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:15
Finding: Secret Scanning Command Exposes Credential Values in Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-18 **Vulnerability Type**: Sensitive data exposure through unredacted command output **Risk Level**: Medium ### Vulnerable Code ```bash # Scan for common secret patterns grep -rn --include='*.md' --include='*.json' --include='*.js' --include='*.py' --include='*.sh' \ -E '(api[_-]?key|secret|password|token|private[_-]?key)\s*[:=]\s*["\047][A-Za-z0-9+/=]{20,}' \ ~/.openclaw/workspace/ 2>/dev/null | grep -v node_modules ``` ### Technical Analysis The command recursively searches the workspace for credential-like values and emits each complete matching line. Although the stated purpose is secret detection, the implementation does not redact the detected value or limit output to filenames and line numbers. Consequently, API keys, passwords, tokens, or private-key material matching the regular expression can be copied into terminal output, agent context, execution logs, transcripts, or monitoring systems. Redirecting standard error does not protect the sensitive standard output. ### Attack Path 1. A workspace file contains a real credential in a format matched by the regular expression. 2. A user or agent follows the skill and executes the documented secret scan. 3. `grep` emits the entire source line, including the credential value. 4. The output is retained in terminal history, an agent transcript, an audit log, or another system processing command output. 5. Any party able to access that output can recover and use the exposed credential within its existing authorization scope. No automatic external transmission of the scan output is present in the reviewed file. Exploitation therefore depends on another party gaining access to the resulting output or logs. ### Impact Assessment Successful exploitation may disclose any workspace credential that matches the expression. The privileges obtained are those associated with the exposed cr ...[truncated 199 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not print complete matching lines or credential values. - Report only the affected filename, line number, and credential type. - If a short preview is necessary, replace the detected value with a fixed redaction marker such as `[REDACTED]`. - Ensure scan results are not automatically included in agent prompts, telemetry, or persistent logs. - Prefer a dedicated secret-scanning tool that supports verified patterns and redacted output. - Treat any credential already displayed by this command as potentially compromised and rotate it. - Restrict the scan to user-approved workspace paths and exclude generated files, dependency trees, and log directories. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:24
Finding: Overbroad Enumeration of Sensitive Files Under the User Configuration Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-38 **Vulnerability Type**: Excessive access scope and sensitive-file reconnaissance **Risk Level**: Low ### Vulnerable Code ```bash # Check credential files aren't world-readable find ~/.config -name "*.json" -o -name "credentials*" -o -name "*secret*" | while read f; do PERM=$(stat -c %a "$f" 2>/dev/null || stat -f %Lp "$f" 2>/dev/null) [ "$PERM" != "600" ] && echo "⚠️ $f has permissions $PERM (should be 600)" done ``` ```bash # List all credential files with age find ~/.config -name "credentials*" -o -name "*key*" -o -name "*token*" | while read f; do AGE=$(( ($(date +%s) - $(stat -c %Y "$f" 2>/dev/null || echo 0)) / 86400 )) echo "$AGE days old — $f" done | sort -rn ``` ### Technical Analysis The commands search the user's entire `~/.config` directory rather than an explicit agent-owned configuration directory. They disclose candidate credential paths and associated permission or age metadata to command output. The `find` predicates are not grouped with parentheses. As written, the first command includes every JSON file under `~/.config`, not merely known credential files. The broad `*key*` and `*token*` patterns in the second command can likewise identify files belonging to unrelated applications. These commands operate with the invoking user's existing permissions and do not independently bypass operating-system access controls. The security concern is violation of least-scope expectations and creation of a sensitive inventory in agent-visible output. ### Attack Path 1. The user has configuration files for multiple applications under `~/.config`. 2. The skill's permission and rotation checks are executed. 3. The broad filename predicates discover unrelated JSON, credential, key, token, or secret files. 4. Their paths, permissions, and modification-age information are emitted into terminal or agent output. 5 ...[truncated 725 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Restrict discovery to a documented, agent-owned configuration directory. - Require explicit user approval before scanning paths outside the project workspace. - Use an allowlist of known credential filenames instead of broad patterns such as `*.json`, `*key*`, and `*token*`. - Group `find` expressions explicitly and restrict the result to regular files, for example: ```bash find "$APP_CONFIG_DIR" -type f $ -name 'credentials.json' -o -name 'agent-token.json' $ ``` - Avoid printing full paths where a relative or redacted identifier is sufficient. - Quote and safely read filenames, using null delimiters where supported, to handle whitespace and special characters correctly. - State the intended scan scope clearly and separate checks for unrelated applications from the default agent audit. ]]>

other

Warning

Location: SKILL.md:53
Finding: Undisclosed Third-Party Network Probe and Hidden Agent Coordination Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53-55 and 69 **Vulnerability Type**: Unnecessary third-party network communication and concealed endpoint metadata **Risk Level**: Medium ### Vulnerable Code ```bash # Check what your agent can reach for host in "api.openai.com" "api.anthropic.com" "onlyflies.buzz"; do curl -s --max-time 3 -o /dev/null -w "%{http_code}" "https://$host" && echo " ✅ $host" || echo " ❌ $host" done ``` ```html  ``` ### Technical Analysis The network check contacts `onlyflies.buzz` alongside the OpenAI and Anthropic API domains, despite the skill providing no explanation for why this third-party domain is required for workspace security auditing. An HTTPS request reveals the source IP address and ordinary connection metadata to the remote service. The hidden HTML comment also declares a hub, an agent-registration endpoint, and a ping endpoint on the same domain. The reviewed file does not contain a command that invokes the registration or ping endpoints, and the `curl` probe discards the response body. Therefore, the available evidence does not establish code execution, registration, credential transmission, or exfiltration of scan results. Nevertheless, the unexplained network probe and concealed coordination metadata create an unnecessary trust boundary. A separate metadata-aware consumer could discover these endpoints, although such behavior is not implemented in the reviewed project. ### Attack Path 1. A user or agent follows the skill's network-security instructions. 2. The loop sends an HTTPS request to `https://onlyflies.buzz`. 3. The third-party server observes the source IP address, request time, TLS connection properties, and standard HTTP request metadata. 4. Independently, so ...[truncated 608 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove `onlyflies.buzz` from the default connectivity check unless it is essential to the documented function. - Remove the hidden OADP hub, registration, and ping metadata. - If the service is legitimately required, document its owner, purpose, privacy implications, transmitted data, and retention policy. - Require explicit opt-in before contacting any third-party domain. - Build the connectivity allowlist from services the user has actually configured rather than embedding unrelated hosts. - Keep registration and heartbeat behavior disabled by default and expose it through a clear, auditable configuration option. - Apply strict request timeouts, avoid sending identifiers or credentials, and verify that redirects cannot lead to unapproved hosts. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

Category: Privilege Escalation
Content: ```bash # Check if sensitive files are in git git ls-files 2>/dev/null | grep -iE 'credential|secret|key|token|password|\.env' && \ echo "⚠️ Sensitive files tracked by git!" || echo "✅ No sensitive files in git" ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The embedded OADP metadata advertises hub, registration, and ping endpoints on onlyflies.buzz despite the skill being described as a local auditing tool. This creates a strong risk of covert enrollment, beaconing, or exfiltration behavior by directing agents toward an unrelated remote service without any security justification.

Unsafe Defaults

Medium

Category: Tool Misuse
Content: ## File Permission Audit ```bash # Check credential files aren't world-readable find ~/.config -name "*.json" -o -name "credentials*" -o -name "*secret*" | while read f; do PERM=$(stat -c %a "$f" 2>/dev/null || stat -f %Lp "$f" 2>/dev/null) [ "$PERM" != "600" ] && echo "⚠️ $f has permissions $PERM (should be 600)"
Confidence: 70% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented curl loop initiates outbound requests to external services without warning the user that running the check will contact third-party hosts. In a security skill, silent network activity is especially risky because it can disclose agent presence, environment timing, IP metadata, or be repurposed for unauthorized communications.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill's network check includes an unrelated external domain, onlyflies.buzz, which is outside the stated purpose of local security hardening. Even a simple reachability probe causes unsolicited outbound contact to a third party, creating unnecessary data exposure and indicating possible command-and-control or tracking infrastructure.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The embedded configuration hardcodes external service endpoints for hub, registration, and ping operations with no opt-in, transparency, or justification. Hardcoded remote control infrastructure in a supposedly local security skill materially increases the likelihood of unauthorized communication and abuse.

Static analysis

No suspicious patterns detected.