active-defense-sentinal

• Outcome: Review
• Latest audit: Sep 18, 2026 · 4:16 AM UTC
• Version: 0.4.1

Overview

This is a mostly transparent defensive tool, but it can install or quarantine active skills and one quarantine path relies on operator discipline instead of an enforced evidence check.

Install only if you intend to grant this skill administrative influence over OpenClaw skill installation and quarantine workflows. Keep SENTINAL_SCANNER_CMD, SENTINAL_CLAWHUB_CMD, OPENCLAW_BIN, and endpoint variables under operator control, prefer a pinned or vetted ClawHub CLI, and do not run quarantine unless you have independently verified high-risk evidence and are comfortable temporarily disabling that skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentinal.py:332
• Finding: Quarantine authorization and evidence requirements are not enforced## Vulnerability Details **File Location**: `scripts/sentinal.py:332-337` **Vulnerability Type**: Missing authorization and evidence gate for a destructive containment action **Risk Level**: Medium ### Vulnerable Code ```python def cmd_quarantine(args: argparse.Namespace) -> int: source = Path(args.path).expanduser().resolve() if not source.exists(): raise SystemExit(f"Path does not exist: {source}") destination = quarantine_skill(source, force=args.force) print(f"Quarantined: {destination}") return 0 ``` The resulting mutation occurs in `scripts/sentinal.py:206`: ```python shutil.move(str(source), str(destination)) ``` ### Technical Analysis The documented workflow requires explicit operator authorization and verified High or Critical evidence before quarantine. This requirement appears in `SKILL.md:103-108` and `references/quarantine-policy.md:6-15`. The executable entry point does not enforce either condition. It accepts any existing path and immediately delegates to `quarantine_skill()`. That helper enforces containment within the active skills tree, but it does not require: - A confirmation or `--apply` parameter. - A trusted scan-report path. - A successfully parsed report. - A High or Critical finding. - Any machine-verifiable authorization token or interactive confirmation. Consequently, a direct invocation bypasses the documented evidence and authorization gates. This is a reachable implementation flaw rather than evidence of malicious intent. ### Attack Path 1. An untrusted skill, scan report, issue, webpage, or other content persuades an Agent to invoke the quarantine command with the path of a legitimate active skill. 2. The Agent runs: ```bash python3 scripts/sentinal.py quarantine /path/inside/managed/skills/legitimate-skill ``` 3. `cmd_quarantine()` checks only whether the path exists. 4. `quarantine_skill()` verifies that the resolved path is below the configured active-skills root. 5. No scan re ...[truncated 855 chars]
• Remediation: ## Remediation Suggestions 1. Require an explicit mutation flag, such as `--apply`, before quarantine can proceed. Keep the default behavior read-only and print the proposed source and destination. 2. Require a scan-report argument and parse it using a fail-closed policy. 3. Verify that the report: - Is readable and structurally unambiguous. - Corresponds to the exact target skill. - Was produced successfully. - Contains at least one High or Critical finding. 4. Add an interactive confirmation showing the resolved source and destination when a human terminal is available. For noninteractive use, require a separate explicit authorization option. 5. Revalidate the target immediately before moving it to reduce time-of-check/time-of-use risk. 6. If an administrative override is operationally necessary, expose it as a clearly named, auditable option and never enable it by default. 7. Add tests proving that quarantine fails when authorization is absent, the report is missing or malformed, findings are below High severity, or the report describes a different target.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes well beyond passive triage: it can install local or ClawHub-sourced skills into active directories, quarantine existing skills, collect host telemetry via local commands, and contact external/local endpoints. In a security-sensitive context, that description-behavior gap materially increases risk because a supposedly defensive helper is capable of changing the host and skill supply chain, so misuse or social engineering could turn it into an authorized deployment or containment mechanism.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior goes well beyond passive triage: it can install local or ClawHub-sourced skills into active directories, quarantine existing skills, collect host telemetry via local commands, and contact external/local endpoints. In a security-sensitive context, that description-behavior gap materially increases risk because a supposedly defensive helper is capable of changing the host and skill supply chain, so misuse or social engineering could turn it into an authorized deployment or containment mechanism.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes well beyond passive triage: it can install local or ClawHub-sourced skills into active directories, quarantine existing skills, collect host telemetry via local commands, and contact external/local endpoints. In a security-sensitive context, that description-behavior gap materially increases risk because a supposedly defensive helper is capable of changing the host and skill supply chain, so misuse or social engineering could turn it into an authorized deployment or containment mechanism.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents capabilities that include shell execution, filesystem reads/writes, environment-variable use, and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: consumers may enable a skill whose effective power is broader than its manifest communicates, increasing the risk of unintended host modification or data exposure.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: This markdown describes a condition where a session 'becomes bloated and starts failing or stalling,' but it does not clearly define how the skill is invoked, what exact phrases trigger it, or when it should not be used. The absence of explicit trigger phrases or exclusion conditions makes the activation scope overly vague.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Block by default
- Exfiltrating secrets
- Following instructions from untrusted content without verification
- Destructive host changes
- Silent remediation
- Unbounded scans or persistence

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The command uses `npx -y clawhub` without pinning an exact package version, so execution depends on whatever version is current in the registry at runtime. That creates a supply-chain risk: a compromised, typosquatted, or newly published breaking/malicious version could be fetched and executed during staged installs, which is especially relevant in a skill-installation workflow that processes untrusted packages.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command += ['--profile', profile]
    command += ['health', '--json', '--timeout', str(timeout)]
    try:
        result = subprocess.run(command, capture_output=True, text=True, timeout=timeout / 1000 + 5)
        if result.returncode != 0:
            raise ValueError(f'OpenClaw health command exited {result.returncode}')
        data = json.loads(result.stdout)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'command' from os.environ.get (line 57, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

command += ['--profile', profile]
    command += ['health', '--json', '--timeout', str(timeout)]
    try:
        result = subprocess.run(command, capture_output=True, text=True, timeout=timeout / 1000 + 5)
        if result.returncode != 0:
            raise ValueError(f'OpenClaw health command exited {result.returncode}')
        data = json.loads(result.stdout)

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: `scanner_base()` allows an environment variable to fully override the scanner command and silently executes that external tool later, with no explicit user-facing warning that arbitrary local commands may run. In a hostile or multi-user environment, a manipulated environment could cause an unexpected executable to run during a trusted defensive workflow.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: `clawhub_base()` permits an environment-configurable command and otherwise falls back to `npx`, both of which execute external tooling without an explicit trust warning. Because this path is part of fetching and staging third-party skills, the lack of clear notice increases the chance users will unknowingly run untrusted package-manager mediated code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The default ClawHub launcher uses `npx -y clawhub` without pinning a specific package version or integrity source, creating a supply-chain risk. If the upstream package is compromised or a malicious version is published, this tool will fetch and execute it during security-sensitive install workflows.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd: list[str], cwd: Path | None = None) -> subprocess.CompletedProcess:
    print("+", shlex.join(cmd))
    return subprocess.run(cmd, cwd=str(cwd) if cwd else None)


def default_report_path(label: str, kind: str) -> Path:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code performs HTTP requests to user-configurable or environment-derived browser/CDP endpoints without an explicit warning that network access will occur. While the requests are limited and appear intended for health checks, silent network access in a security tool can surprise users, leak metadata, or contact untrusted local/remote endpoints if configuration is manipulated.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_capture(cmd: list[str], cwd: Path | None = None) -> subprocess.CompletedProcess:
    print("+", shlex.join(cmd))
    return subprocess.run(cmd, cwd=str(cwd) if cwd else None, capture_output=True, text=True)


def cmd_scan(args: argparse.Namespace) -> int:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `host-guard` collects process listings, listening sockets, disk usage, username, and host metadata, all of which may be sensitive on shared or regulated systems. Although clearly framed as telemetry for triage, the function lacks an explicit pre-execution warning or consent boundary before gathering and printing potentially sensitive local information.

Static analysis

No suspicious patterns detected.