Security audit

Folder Inspector

Security checks for vulnerabilities and agentic risk

Overview

This folder-inspection skill has a coherent purpose, but its implementation can turn a folder path into arbitrary shell command execution and also logs inspected paths to a predictable temporary file.

Review this before installing. The useful behavior is simple local folder listing, but a malicious or malformed path could cause shell commands to run as the agent user, and inspected paths are written to an undocumented /tmp log. Prefer a version that uses argument-array process execution or native filesystem APIs, removes or secures debug logging, and resolves its helper script from the installed skill directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:18
Finding: OS Command Injection Through the Directory Path Argument## Vulnerability Details **File Location**: `index.js`, lines 18-23 **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```javascript const pythonPath = '/usr/bin/python3'; const scriptPath = '/home/jiajiexu/.nvm/versions/node/v22.20.0/lib/node_modules/@qingchencloud/openclaw-zh/skills/folder_inspector/scripts/file_scanner.py'; // Execute Python and capture its output const stdout = execSync(`${pythonPath} ${scriptPath} "${args.path}"`); ``` ### Technical Analysis The skill passes the untrusted `args.path` value into a command string executed by `child_process.execSync`. This API invokes a shell, so shell metacharacters in the path are interpreted as command syntax. Surrounding the value with double quotes does not make this safe. An attacker can include a double quote in the supplied path to terminate the quoted argument and then append shell operators and commands. The parameter schema only requires a string and does not prevent quotes, semicolons, command substitutions, redirections, or other shell syntax. An illustrative malicious argument is: ```text "; id > /tmp/folder_inspector_proof; # ``` It produces a command equivalent to: ```sh /usr/bin/python3 /path/to/file_scanner.py ""; id > /tmp/folder_inspector_proof; #" ``` The shell consequently executes the injected `id` command independently of the Python scanner. ### Attack Path 1. An attacker gains the ability to invoke the skill or influence its `path` argument. 2. The attacker submits a path containing a closing quote followed by shell commands, such as `"; id > /tmp/folder_inspector_proof; #`. 3. The handler interpolates the value directly into the command string. 4. `execSync` passes the resulting string to a shell. 5. The shell interprets and executes the appended command. 6. The attacker can replace the demonstration command with commands that read, modify, delete, or transmit data accessib ...[truncated 702 chars]
Remediation: ## Remediation Suggestions Do not construct a shell command containing user-controlled data. Invoke Python with an argument-array API and disable shell processing. ```javascript const path = require('path'); const { execFileSync } = require('child_process'); const pythonPath = '/usr/bin/python3'; const scriptPath = path.join(__dirname, 'scripts', 'file_scanner.py'); const stdout = execFileSync( pythonPath, [scriptPath, args.path], { encoding: 'utf8', shell: false } ); ``` Additional hardening should include: - Require `args.path` to be a nonempty absolute path. - Resolve and normalize the path before use. - If the skill is intended to inspect only approved locations, enforce an explicit allowlist of root directories and verify the resolved path remains beneath an allowed root. - Run the skill under a dedicated, least-privileged operating-system account. - Apply execution timeouts and output-size limits to the child process. - Resolve the bundled scanner relative to `__dirname` rather than using a machine-specific global installation path. - Treat validation as defense in depth; argument-array execution must remain the primary command-injection control.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/file_scanner.py:6
Finding: Unsafe Predictable Debug Log in a Shared Temporary Directory## Vulnerability Details **File Location**: `scripts/file_scanner.py`, lines 6-8 and line 34 **Vulnerability Type**: Unsafe temporary-file handling and sensitive path disclosure **Risk Level**: Medium ### Vulnerable Code ```python def debug_log(message): with open("/tmp/openclaw_python_debug.log", "a") as f: f.write(f"{datetime.datetime.now()}: {message}\n") ``` The user-controlled path is written to that log: ```python target_path = sys.argv[1] if len(sys.argv) > 1 else "." debug_log(f"脚本被调用了！参数路径: {target_path}") ``` ### Technical Analysis The scanner appends data to a fixed, predictable filename in the shared `/tmp` directory. It does not securely create the file, verify ownership, reject symbolic links, or enforce restrictive permissions. A local attacker may pre-create `/tmp/openclaw_python_debug.log` as a symbolic link. If the process can follow that link and write to its target, invoking the skill causes attacker-influenced log content to be appended to the target file. Operating-system protections such as Linux protected-symlink settings may limit this attack in some environments, but the application does not enforce such protection itself. The log also persistently records each caller-supplied directory path. Paths can disclose usernames, project names, mounted resources, customer identifiers, or other sensitive filesystem structure. Because the destination is under a shared temporary directory and no explicit mode is set, confidentiality depends on ambient ownership, umask, and host configuration. The input can contain newline characters, allowing forged log entries or misleading multi-line log content, although the fixed timestamped prefix limits direct control of the first line. ### Attack Path A symlink-based exploitation path is: 1. A local attacker predicts the fixed filename `/tmp/openclaw_python_debug.log`. 2. Before the scanner creates or opens it, the attacker creates that p ...[truncated 1124 chars]
Remediation: ## Remediation Suggestions Remove the debug log if it is not operationally necessary. Production code should not persist user-supplied paths merely to record scanner invocation. If logging is required: - Use the application's established logging framework. - Store logs in an application-owned directory that is not writable by untrusted users. - Restrict the directory to the service account, such as mode `0700`. - Create log files with restrictive permissions, such as mode `0600`. - Use secure file-opening controls that reject symbolic links, including `O_NOFOLLOW` where supported. - Verify that the opened object is a regular file owned by the expected service account. - Sanitize carriage returns and newline characters to prevent log-entry injection. - Avoid recording full user-supplied paths, or redact sensitive path components. - Configure log rotation and retention limits to prevent uncontrolled growth. A secure design should create and validate the logging directory during deployment rather than relying on a predictable file in `/tmp`.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: All user-facing natural-language description and invocation examples are written only in Chinese, and the skill does not indicate that language is optional or user-selectable. This can violate language/locale policy when the broader environment expects respecting the user's preferred language unless explicitly constrained.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions are broad and include a mandatory instruction to call the tool whenever users ask about directory contents or folder size. This can cause over-invocation on common requests, increasing the chance of unnecessary filesystem access, exposure of sensitive local path contents, or the tool being selected in contexts where user intent is ambiguous.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The handler constructs a shell command and invokes a local Python subprocess even though the skill only needs to enumerate a folder. Introducing execSync expands the attack surface substantially because a user-controlled path is interpolated into a shell command, which can lead to command injection or abuse of local execution capabilities if quoting is bypassed. In the context of a folder-scanning skill, spawning a subprocess is more dangerous than necessary and unjustified by the stated functionality.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code passes a user-supplied path into execSync via a shell-constructed command string: `${pythonPath} ${scriptPath} "${args.path}"`. Because shell metacharacters inside the path can break out of quoting or trigger command substitution, an attacker may execute arbitrary commands on the host. The skill context makes this especially dangerous because it is explicitly designed to accept arbitrary filesystem paths from the caller.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file contains natural-language comments and runtime error/log strings in Chinese, such as the path error message and invocation log text. This imposes a specific language on users without any opt-in, alternative locale handling, or documented justification for a Chinese-only audience.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: The natural-language description is presented only in Chinese, which can impose a specific language on users without opt-in. The file does not indicate that the skill is intentionally restricted to a Chinese-language or region-specific environment.

Description-Behavior Mismatch

Low

Confidence: 94% confidence
Finding: The skill’s stated purpose is only to scan a local directory, but it also performs an undocumented side effect by writing execution data to a fixed file in /tmp. Hidden logging expands the data-handling surface and may expose sensitive path information or create privacy and integrity issues on multi-user systems.

Missing User Warnings

Low

Confidence: 97% confidence
Finding: The user-supplied directory path is written directly to a debug log without notice, which can leak sensitive filesystem structure such as usernames, project names, or secret-bearing paths. Because the log file is fixed under /tmp, other local users or processes may be able to discover or tamper with this metadata depending on environment and permissions.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:23