ClawHub
Back to skill

Security audit

Warp Oz

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Warp Oz API wrapper for launching and managing cloud coding agents, with expected remote-agent, scheduling, and API-token use.

Install only if you trust Warp Oz with the target repository and tasks. Use a least-privilege Warp API key and environment, avoid reusing conversation sandboxes for sensitive or untrusted work, review any generated code or PRs before merging, and be deliberate with schedule create/update/delete commands because they affect remote automated runs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code substantially matches the orchestrator portion of the description: it dispatches Oz cloud-agent runs, polls status, chains multiple stages, optionally shares a conversation/sandbox via conversation_id, and performs severity-based retry loops. However, the declared description is broader and presents the skill as including a bash wrapper covering every Oz API endpoint and capabilities such as schedules, artifacts, and agent management, none of which appear in this supplied code chunk. The actual entrypoint is a local Python CLI rather than 'all from chat.' Because the supplied code implements only a subset of the declared functionality, the description does not accurately represent what this code chunk itself actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code substantially matches part of the description: it is clearly a Warp Oz cloud API wrapper and does implement runs, polling, schedules, artifacts, agents, and session/conversation-related run options. However, the declared purpose prominently includes a Python pipeline orchestrator that chains specialized agents into multi-agent review pipelines with severity-based retries. None of that behavior appears in the supplied code chunk, which is only a shell wrapper around HTTP endpoints. This is a material description-behavior mismatch because a major advertised capability is missing from the actual code shown.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 110)May include surrounding context.

md
Required fields: `cron_schedule`, `name`, `enabled`. Optional: `prompt`, `agent_config`.
Response: ScheduledAgentItem.

### DELETE /agent/schedules/{scheduleId} — Delete schedule
Response: confirmation.

### POST /agent/schedules/{scheduleId}/pause — Pause schedule

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/oz-api.sh (reported line 285)May include surrounding context.

sh
cmd_schedule_delete() {
  local schedule_id="${1:?schedule_id required}"
  api_call_verbose DELETE "/agent/schedules/${schedule_id}"
}

cmd_schedule_pause() {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises capabilities that rely on shell, network, and environment access but does not declare any tool scope or permission boundaries. This weakens user understanding and platform enforcement, increasing the chance that the skill executes with broader authority than expected, including access to sensitive environment variables like API tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages dispatching cloud agents against a user's repository and mentions PR creation, but it does not clearly warn that remote agents may modify code, operate on repository contents, and create artifacts or pull requests. Users may invoke it without understanding that untrusted prompts are being executed in a cloud sandbox with write-like effects on their project lifecycle.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The multi-turn conversation feature reuses the same sandbox and context across runs, but the documentation does not warn that secrets, prior outputs, and sensitive repository state may persist across turns. This can lead to unintended data retention, cross-task contamination, or prompt-injection persistence when users continue a conversation assuming each run is isolated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 63)May include surrounding context.

python
if key:
        return key
    try:
        result = subprocess.run(
            ["op", "read", OP_REFERENCE],
            capture_output=True, text=True, timeout=10
        )

Tainted flow: 'OP_REFERENCE' from os.environ.get (line 33, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/orchestrator.py (reported line 63)May include surrounding context.

python
if key:
        return key
    try:
        result = subprocess.run(
            ["op", "read", OP_REFERENCE],
            capture_output=True, text=True, timeout=10
        )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script exposes a destructive DELETE operation for schedules, but this function contains no confirmation prompt and no user-facing warning that it will remove a schedule. Aside from the bare command listing, there is no disclosure in the code comments or output describing the destructive effect before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file instructs users to supply a bearer API key via WARP_API_KEY or a 1Password reference, but it does not include any warning that these values are sensitive credentials and should not be exposed in logs, code, or shared configs. Under the markdown variant of SQP-2, documenting privacy- or security-relevant behavior without user warning can merit a finding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The run command sends user-provided prompt, title, conversation, and configuration data to a remote API endpoint, but the function provides no user-facing notice at the point of transmission. While the script is an API wrapper, there is no explicit warning in this file that entered prompts and metadata are sent to Warp's service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The schedule-create command posts prompt and agent configuration data to the remote API, but the file does not clearly warn users that this content is transmitted and stored remotely as a scheduled task. For operations involving scheduled execution, an explicit disclosure is helpful because user data persists beyond the immediate command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.