Rubber Duck Deluxe

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:15 AM UTC
• Version: 1.0.0

Overview

This is a Markdown-only debugging persona skill with no code execution or persistence, though one example gives unsafe force-termination advice that users should not follow blindly.

Reasonable to install if you want a conversational debugging helper. Treat all shell snippets as illustrative: verify the target process, prefer graceful shutdown or changing ports, and require explicit approval before terminating anything.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:240

Finding

Unsafe Force-Termination Guidance for Port Conflicts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 240–242
Vulnerability Type: Unsafe process termination guidance
Risk Level: Medium

text

         Fire the cannons! (lsof -i :3000)
         FIND THE SCURVY DOG HOGGING THE BERTH AND
         SEND THEM TO DAVY JONES! (kill -9)

Technical Analysis

The Pirate personality recommends identifying a process bound to port 3000 and terminating it with kill -9. This sends SIGKILL, which immediately terminates the target process without allowing cleanup handlers, transaction rollback, buffered-data flushing, or graceful resource release.

The instructions do not require the agent or user to confirm the process identity, ownership, operational importance, or relationship to the debugging task. They also omit PID-specific safe handling, explicit user confirmation, and an initial graceful termination attempt. Because the file provides behavioral instructions for an agent, this recommendation may result in an unsafe shell action if followed literally or executed autonomously.

Attack Path

1. A user invokes Pirate mode while diagnosing a container that cannot bind to port 3000.
2. The skill recommends running lsof -i :3000 to locate a process using that port.
3. The identified process is treated as safe to terminate without validating its identity, owner, purpose, or criticality.
4. The agent or user applies kill -9 to the process.
5. The process terminates immediately, potentially interrupting active requests, writes, transactions, or other users' workloads.

Impact Assessment

Exploitation does not inherently grant additional privileges or cross a privilege boundary; commands execute with the permissions of the invoking user. However, any process that user is authorized to signal may be terminated. The resulting scope can include local service availability loss, interruption of unrelated workloads, loss of unflushed data, and inconsistent a ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

Replace the unconditional force-termination recommendation with a guarded procedure:

1. Display the process PID, executable, owner, command line, and listening socket before taking action.
2. Confirm that the process belongs to the affected application and is not a required or unrelated service.
3. Request explicit user approval before terminating any process.
4. Prefer resolving the conflict by stopping the known service through its service manager or selecting another host port, such as docker run -p 3001:3000.
5. If termination is necessary, send SIGTERM first and allow a reasonable grace period for cleanup.
6. Verify whether the process exited before escalating.
7. Reserve SIGKILL for a confirmed, unresponsive process and require separate explicit confirmation before using it.
8. Avoid suggesting elevated privileges unless they are demonstrably required and approved.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: rubber-duck-deluxe
version: 1.0.0
description: >
  The classic rubber duck debugging technique, upgraded with personality
  modes. Choose your duck: Socrates asks devastating questions until you
  find the answer yourself. Gordon Ramsay screams at your logic. A Zen
  Master responds in koans. A Toddler asks "but why?" recursively until
  you reach first principles. Same technique — dramatically more fun.
author: J. DeVere Cooley
category: fun-tools
tags:
  - debugging
  - rubber-duck
  - personality
  - socratic-method
metadata:
  openclaw:
    emoji: "🦆"
    os: ["darwin", "linux", "win32"]
    cost: free
    requires_ap

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Pirate example includes destructive operational guidance such as kill -9 without any safety caveat or context checks. Even though presented humorously, users may imitate the commands directly, which can terminate the wrong process or disrupt local services, making the skill more dangerous in a debugging assistant context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance is extremely broad and ends with 'Always. Just pick a duck. Start talking,' encouraging use in virtually any situation without boundaries. In an agent setting, over-broad triggers can cause unnecessary activation, increased prompt exposure, and a higher chance that the skill is used in inappropriate contexts where its stylized advice may include risky debugging suggestions.

Content

No source excerpt is available for this finding.