Folder Inspector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:11 AM UTC
• Version: 1.0.0

Overview

This folder-inspection skill has a coherent purpose, but its implementation can turn a folder path into arbitrary shell command execution and also logs inspected paths to a predictable temporary file.

Review this before installing. The useful behavior is simple local folder listing, but a malicious or malformed path could cause shell commands to run as the agent user, and inspected paths are written to an undocumented /tmp log. Prefer a version that uses argument-array process execution or native filesystem APIs, removes or secures debug logging, and resolves its helper script from the installed skill directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:18

Finding

OS Command Injection Through the Directory Path Argument

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 18-23
Vulnerability Type: OS command injection
Risk Level: Critical

Vulnerable Code

javascript

const pythonPath = '/usr/bin/python3'; 
const scriptPath = '/home/jiajiexu/.nvm/versions/node/v22.20.0/lib/node_modules/@qingchencloud/openclaw-zh/skills/folder_inspector/scripts/file_scanner.py';

// Execute Python and capture its output
const stdout = execSync(`${pythonPath} ${scriptPath} "${args.path}"`);

Technical Analysis

The skill passes the untrusted args.path value into a command string executed by child_process.execSync. This API invokes a shell, so shell metacharacters in the path are interpreted as command syntax.

Surrounding the value with double quotes does not make this safe. An attacker can include a double quote in the supplied path to terminate the quoted argument and then append shell operators and commands. The parameter schema only requires a string and does not prevent quotes, semicolons, command substitutions, redirections, or other shell syntax.

An illustrative malicious argument is:

text

"; id > /tmp/folder_inspector_proof; #

It produces a command equivalent to:

sh

/usr/bin/python3 /path/to/file_scanner.py ""; id > /tmp/folder_inspector_proof; #"

The shell consequently executes the injected id command independently of the Python scanner.

Attack Path

1. An attacker gains the ability to invoke the skill or influence its path argument.
2. The attacker submits a path containing a closing quote followed by shell commands, such as "; id > /tmp/folder_inspector_proof; #.
3. The handler interpolates the value directly into the command string.
4. execSync passes the resulting string to a shell.
5. The shell interprets and executes the appended command.
6. The attacker can replace the demonstration command with commands that read, modify, delete, or transmit data accessib ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

Do not construct a shell command containing user-controlled data. Invoke Python with an argument-array API and disable shell processing.

javascript

const path = require('path');
const { execFileSync } = require('child_process');

const pythonPath = '/usr/bin/python3';
const scriptPath = path.join(__dirname, 'scripts', 'file_scanner.py');

const stdout = execFileSync(
  pythonPath,
  [scriptPath, args.path],
  {
    encoding: 'utf8',
    shell: false
  }
);

Additional hardening should include:

• Require args.path to be a nonempty absolute path.
• Resolve and normalize the path before use.
• If the skill is intended to inspect only approved locations, enforce an explicit allowlist of root directories and verify the resolved path remains beneath an allowed root.
• Run the skill under a dedicated, least-privileged operating-system account.
• Apply execution timeouts and output-size limits to the child process.
• Resolve the bundled scanner relative to __dirname rather than using a machine-specific global installation path.
• Treat validation as defense in depth; argument-array execution must remain the primary command-injection control.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/file_scanner.py:6

Finding

Unsafe Predictable Debug Log in a Shared Temporary Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/file_scanner.py, lines 6-8 and line 34
Vulnerability Type: Unsafe temporary-file handling and sensitive path disclosure
Risk Level: Medium

Vulnerable Code

python

def debug_log(message):
    with open("/tmp/openclaw_python_debug.log", "a") as f:
        f.write(f"{datetime.datetime.now()}: {message}\n")

The user-controlled path is written to that log:

python

target_path = sys.argv[1] if len(sys.argv) > 1 else "."
debug_log(f"脚本被调用了！参数路径: {target_path}")

Technical Analysis

The scanner appends data to a fixed, predictable filename in the shared /tmp directory. It does not securely create the file, verify ownership, reject symbolic links, or enforce restrictive permissions.

A local attacker may pre-create /tmp/openclaw_python_debug.log as a symbolic link. If the process can follow that link and write to its target, invoking the skill causes attacker-influenced log content to be appended to the target file. Operating-system protections such as Linux protected-symlink settings may limit this attack in some environments, but the application does not enforce such protection itself.

The log also persistently records each caller-supplied directory path. Paths can disclose usernames, project names, mounted resources, customer identifiers, or other sensitive filesystem structure. Because the destination is under a shared temporary directory and no explicit mode is set, confidentiality depends on ambient ownership, umask, and host configuration.

The input can contain newline characters, allowing forged log entries or misleading multi-line log content, although the fixed timestamped prefix limits direct control of the first line.

Attack Path

A symlink-based exploitation path is:

1. A local attacker predicts the fixed filename /tmp/openclaw_python_debug.log.
2. Before the scanner creates or opens it, the attacker creates that p ...[truncated 1124 chars]

Remediation

View remediation

Remediation Suggestions

Remove the debug log if it is not operationally necessary. Production code should not persist user-supplied paths merely to record scanner invocation.

If logging is required:

• Use the application's established logging framework.
• Store logs in an application-owned directory that is not writable by untrusted users.
• Restrict the directory to the service account, such as mode 0700.
• Create log files with restrictive permissions, such as mode 0600.
• Use secure file-opening controls that reject symbolic links, including O_NOFOLLOW where supported.
• Verify that the opened object is a regular file owned by the expected service account.
• Sanitize carriage returns and newline characters to prevent log-entry injection.
• Avoid recording full user-supplied paths, or redact sensitive path components.
• Configure log rotation and retention limits to prevent uncontrolled growth.

A secure design should create and validate the logging directory during deployment rather than relying on a predictable file in /tmp.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

All user-facing natural-language description and invocation examples are written only in Chinese, and the skill does not indicate that language is optional or user-selectable. This can violate language/locale policy when the broader environment expects respecting the user's preferred language unless explicitly constrained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger conditions are broad and include a mandatory instruction to call the tool whenever users ask about directory contents or folder size. This can cause over-invocation on common requests, increasing the chance of unnecessary filesystem access, exposure of sensitive local path contents, or the tool being selected in contexts where user intent is ambiguous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The handler constructs a shell command and invokes a local Python subprocess even though the skill only needs to enumerate a folder. Introducing execSync expands the attack surface substantially because a user-controlled path is interpolated into a shell command, which can lead to command injection or abuse of local execution capabilities if quoting is bypassed. In the context of a folder-scanning skill, spawning a subprocess is more dangerous than necessary and unjustified by the stated functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code passes a user-supplied path into execSync via a shell-constructed command string: ${pythonPath} ${scriptPath} "${args.path}". Because shell metacharacters inside the path can break out of quoting or trigger command substitution, an attacker may execute arbitrary commands on the host. The skill context makes this especially dangerous because it is explicitly designed to accept arbitrary filesystem paths from the caller.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains natural-language comments and runtime error/log strings in Chinese, such as the path error message and invocation log text. This imposes a specific language on users without any opt-in, alternative locale handling, or documented justification for a Chinese-only audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language description is presented only in Chinese, which can impose a specific language on users without opt-in. The file does not indicate that the skill is intentionally restricted to a Chinese-language or region-specific environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s stated purpose is only to scan a local directory, but it also performs an undocumented side effect by writing execution data to a fixed file in /tmp. Hidden logging expands the data-handling surface and may expose sensitive path information or create privacy and integrity issues on multi-user systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-supplied directory path is written directly to a debug log without notice, which can leak sensitive filesystem structure such as usernames, project names, or secret-bearing paths. Because the log file is fixed under /tmp, other local users or processes may be able to discover or tamper with this metadata depending on environment and permissions.

Content

No source excerpt is available for this finding.