T09 · Insecure Skill Coding Practices
Error
- Location
phases/05-training.md:61- Finding
Unsafe Extraction and Recursive Transfer of User-Controlled Archives
- Content
View full analysis
- Remediation
View remediation
Security audit
Lora Pipeline
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent LoRA training workflow, but it handles face datasets through scraping, biometric matching, remote GPU training, and broad file operations without enough consent, provenance, and containment safeguards.
Review this skill carefully before installing. Use it only for datasets you have rights and consent to process, avoid login-bypass or mirror scraping, inspect ZIP inputs in a sandbox before training, and treat RunPod uploads as disclosure of the full dataset to a third-party compute environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
phases/05-training.md:39- Finding
Third-Party Training Image and Model Artifacts Are Not Cryptographically Pinned
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says to use this skill whenever a user asks to build a training dataset, collect photos for a LoRA, or train a LoRA, which is broad enough to activate on many ordinary requests without first confirming consent, subject rights, or safety constraints. In this context, over-broad triggering is risky because the skill includes scraping, facial verification, and remote training steps involving sensitive personal data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises dataset scraping and RunPod-based training but does not prominently warn users that it may collect images from external sources and transmit training data or artifacts to remote infrastructure. Because the workflow processes face images and biometric matching, the missing disclosure increases the likelihood of privacy violations, unauthorized data collection, or accidental transfer of sensitive datasets to third parties.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The privacy section forbids reading or analyzing image and caption contents, yet the pipeline’s core phases explicitly require face verification, quality filtering, cropping, and caption generation, all of which depend on inspecting those files. This contradiction can cause unsafe operator workarounds, inconsistent handling of sensitive biometric data, or bypass of intended privacy controls because the documented rules are not operationally compatible with the workflow.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The fallback instruction to write status data to ~/.openclaw/workspace/lora_status_phase1.txt introduces persistent local state outside the primary session channel. Persistent files can leak workflow metadata across runs, be read by other local processes or users depending on permissions, and create unintended cross-session coupling if later phases trust this file as authoritative state.
- Content
sessions_send(parent_session_id, "✅ Phase 1–2 complete: reference photos verified and approved for <lora_name>. Ready for Phase 3 (scraping).")
text Fallback: write to `~/.openclaw/workspace/lora_status_phase1.txt` ## Model Recommendation
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
Writing phase status to a fixed path under the user's home directory creates cross-session persistence outside the task workspace. That can leak sensitive project identifiers such as the LoRA name, create unintended state carryover between runs, and allow other local processes or users with access to that path to observe workflow activity.
- Content
sessions_send(parent_session_id, "✅ Phase 3 complete: raw images collected for <lora_name> in datasets/<lora_name>_raw/. Ready for Phase 4 (verify & clean).")
text Fallback: write to `~/.openclaw/workspace/lora_status_phase3.txt` ## Model Recommendation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill operationalizes scraping and local storage of third-party face images without warning about consent, copyright, privacy, biometric sensitivity, or platform terms. In a face-dataset pipeline, omission of those safeguards materially increases the chance of unlawful or unsafe collection of personal images at scale.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs use of Instagram mirror sites to bypass normal platform login controls for image collection. That meaningfully expands the agent's data-access capability beyond ordinary browsing and encourages acquisition of third-party content through evasion-oriented sources, which raises privacy, compliance, and misuse risk in a face-dataset workflow.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Writing status data to a fixed path under ~/.openclaw/workspace creates persistent local artifacts that may expose sensitive workflow details such as dataset names, processing status, or identities inferred from lora_name. Because the path is predictable and outside the immediate task output directory, other local users, processes, or later sessions may read or misuse that information if permissions and cleanup are not tightly controlled.
- Content
sessions_send(parent_session_id, "✅ Phase 4 complete: images passed verification for <lora_name>. rejected. Dataset at datasets/<lora_name>/. Ready for Phase 5 (caption).")
text Fallback: write to `~/.openclaw/workspace/lora_status_phase4.txt` ## Model Recommendation
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Line L029 introduces a section heading in Chinese ("確認照片正確") while the rest of the file is primarily in English. This imposes a language choice on users without opt-in or justification, which matches the policy category for language or locale violations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
Writing workflow status to a persistent file under a fixed path creates residual local state that may reveal dataset names, trigger words, or pipeline progress to other local users or later processes. While the content appears limited, fixed-path persistence can also cause stale-state confusion or unintended cross-run information leakage in shared environments.
- Content
sessions_send(parent_session_id, "✅ Phase 5 complete: images captioned for <lora_name>. Trigger word '' prepended to all captions. Ready for Phase 6 (training).")
text Fallback: write to `~/.openclaw/workspace/lora_status_phase5.txt` ## Model Recommendation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The provided Python snippet unconditionally rewrites existing caption files when the trigger word is missing, with no backup, prompt, or audit trail. In a dataset-preparation pipeline this can silently destroy prior manual edits or inherited metadata, causing integrity loss and making downstream model training rely on altered captions without user awareness.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
Writing workflow status and output paths to a persistent file under ~/.openclaw/workspace creates residual local artifacts that may be accessible to other local users, later processes, or unrelated sessions. Even if it does not store the dataset itself, it can leak sensitive metadata such as project existence, timestamps, pod identifiers, and model output locations.
- Content
sessions_send(parent_session_id, "✅ Phase 6 complete: LoRA training done. Outputs at ~/.openclaw/workspace/lora_outputs//. Files: . Pod <POD_ID> stopped.")
text Fallback: write to `~/.openclaw/workspace/lora_status_phase6.txt` ## Model Recommendation
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The security section explicitly says not to
cat, read, or analyze.txtcaption files and not to describe dataset contents to the LLM. However, the dataset layout example later includes an inline caption content example (DerekLunsford, 1boy, muscular, ...), which contradicts the stated no-inspection/no-description rule by showing caption contents as something to read and expose.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The document hard-codes preferred zones to EU and explicitly prohibits Canada, which is a locale/region policy constraint expressed in natural language. The file does not present this as a user choice or explain a compliance reason for the restriction, so it may violate the requirement not to force a locale without opt-in or justified documentation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
-i "$SSH_KEY"
-o StrictHostKeyChecking=accept-new
-o UserKnownHostsFile=~/.runpod/ssh/known_hosts
"cd /workspace && echo y | nohup python3 /workspace/batch_lora_train.py > /workspace/training.log 2>&1 &"text **Spawn Sentry sub-agent (bash-only polling, zero LLM calls during wait):**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Persisting sentry status to ~/.openclaw/workspace/lora_status_{pod_id}.txt leaves execution state, pod identifiers, and possibly log-derived error details on disk beyond the active session. These artifacts can expose operational metadata and troubleshooting context to unintended readers or future tasks.
- Content
md > - Poll interval: `sleep 30` > - Max: 40 iterations = **20 minutes** then auto-exit > - Sentry makes exactly **1 LLM call total**: to send the final `sessions_send` > - If sentry's API call fails → write status to `~/.openclaw/workspace/lora_status_{pod_id}.txt` as fallback > **NO ESCALATION — ABSOLUTE RULE:** Sentry stays on `openrouter/google/gemini-2.0-flash-lite-001` always. > Prohibited models: Sonnet, Opus, or any higher-tier variant.
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"🚀 {' '.join(cmd)}") try: result = subprocess.run(cmd, cwd=KOHYA_ROOT) return result.returncode == 0 except Exception as e: print(f"❌ 執行失敗: {e}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script unconditionally opens a sidecar .txt file in write mode for every image and will overwrite any existing file with the same basename without warning. If run on a directory containing user-authored annotations or prior tagging results, this can cause silent data loss across many files in one batch.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Several phase labels are written in Chinese while the rest of the document is in English, with no indication that the user prefers or opted into that locale. This can violate language/locale policy expectations when a skill imposes mixed-language instructions without offering a choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The phase headings use Chinese text alongside English (for example, '蒐集範例照片' and '確認人臉正確') but the document does not state that the skill is region-specific or that the user can choose their preferred language. Under the stated policy, forcing or assuming a language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phase heading includes Chinese-language instructions alongside English, but the file does not state that the skill is intended for a Chinese-speaking audience or offer a user language preference. This can violate a language/locale policy when a skill imposes or assumes a language without explicit opt-in or justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Because no manifest or declared scope is provided, browser-side JavaScript evaluation for extraction is an extra capability that cannot be tied to an explicit skill purpose. While scraping may imply browsing, instructing scripted DOM extraction is a stronger capability than ordinary manual collection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The phase heading includes Chinese text (
開始) while the rest of the file is in English, imposing mixed-language content without any user opt-in or documented locale requirement. This can violate language/locale policy when no choice or justification is provided.- Content
Static analysis
No suspicious patterns detected.