ClawHub
Back to skill

Security audit

Demo Slap

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its CS2 highlight purpose, but it publishes untrusted job, chat, and clip data into OpenClaw system events and keeps sensitive runtime data, so it needs review before installation.

Review before installing. Prefer environment-injected API keys over data/config.json, restrict access to the data directory, avoid or tightly scope watchdog jobs, and change the OpenClaw notification path to use typed events or validated/redacted fields before allowing automatic delivery actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
scripts/demo_slap_analyze.py:132
Finding

Untrusted Analysis Metadata Is Injected into a Privileged OpenClaw System Event

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/demo_slap_render.py:180
Finding

API-Controlled Clip Data and CLI Metadata Are Injected into a Privileged OpenClaw System Event

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/demo_slap_common.py:22
Finding

Long-Lived API Keys May Be Stored in an Unprotected Plaintext Configuration File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description is for a broader skill that generates CS2 highlight videos/fragmovies and may use Leetify or match-history fallback to choose matches. This code chunk only covers the analysis stage: submitting a demo URL for analysis, polling status, retrieving highlight metadata, filtering it, persisting results, and notifying another local system. It does not actually render clips or produce MP4 video, which is the core user-facing behavior described. The OpenClaw system event and local file/state handling are additional operational behaviors not reflected in the description. While some of this may be part of a larger pipeline, this specific code chunk's actual behavior is materially narrower and includes an undeclared notification side effect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose centers on media generation from CS2 demos. The actual code chunk does not implement clipping, rendering, demo processing, API interaction, or match selection. Instead, it is an operational support script for inspecting local state (state.json), viewing recent log lines (history.log), and printing a configured cron/watchdog job ID from an environment variable. That is a materially different primary purpose from the declared description, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose centers on CS2 demo-to-video functionality: recording highlights, rendering clips, making fragmovies, and using Demo-Slap/Leetify match history. The actual code does none of that. Instead, it only saves a mapping between a chat username and a Steam64 ID. While Leetify integration is mentioned in the description, this code chunk is specifically an identity-mapping helper and not a direct implementation of highlight generation. That makes the chunk materially different in primary purpose from the declared behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and operationalizes access to environment variables, local file read/write, network access, and shell execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an avoidable over-privilege condition where an agent may invoke broader capabilities than a reviewer or runtime policy expects, increasing the blast radius if the skill is misused or modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill handles replay URLs, usernames, Steam64 mappings, and chat identifiers, and it states that these may be sent to external APIs and persisted in local runtime files, but it does not provide a clear user-facing warning or consent boundary. This creates privacy and compliance risk because users may not realize their identifiers and chat metadata are being transmitted and stored during processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to use or enable a cron/watchdog mechanism for periodic delivery checks, which introduces persistence and scheduled execution beyond the core clip-generation task. Even though it is framed as optional and scoped, scheduled jobs can outlive a single request, create unintended background activity, or be repurposed to poll or deliver data after user interaction has ended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill performs an out-of-band system action by invoking an external CLI to emit a host-level event, which is not necessary for analyzing a demo and expands the skill's authority beyond its stated purpose. Even without shell injection, this creates an unexpected cross-component signaling channel that can leak identifiers like chat_id, trigger other automations, and make the skill capable of influencing the wider agent environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/demo_slap_analyze.py (reported line 136)May include surrounding context.

python
import subprocess
    event_text = f"[demo-slap] Analysis done. JobID: {job_id}. Highlights: {len(highlights)}. ChatID: {chat_id}. Watchdog should send highlights from highlights.json."
    try:
        subprocess.run(["openclaw", "system", "event", "--text", event_text, "--mode", "now"], check=True)
    except Exception as e:
        print(f"⚠️  System event failed: {e}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/demo_slap_render.py (reported line 185)May include surrounding context.

python
import subprocess
    event_text = f"[demo-slap] Analysis done. JobID: {job_id}. Highlights: {len(highlights)}. ChatID: {chat_id}. Watchdog should send highlights from highlights.json."
    try:
        subprocess.run(["openclaw", "system", "event", "--text", event_text, "--mode", "now"], check=True)
    except Exception as e:
        print(f"⚠️  System event failed: {e}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/demo_slap_common.py (reported line 136)May include surrounding context.

python
for attempt in range(1, retries + 1):
        try:
            if method.upper() == "POST":
                r = requests.post(url, json=data, headers=headers, params=params, timeout=30)
            else:
                r = requests.get(url, headers=headers, params=params, timeout=30)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill performs an out-of-scope side effect by invoking an external CLI to emit a system event after rendering. That expands the trust boundary beyond video generation into host-level orchestration/notification, which can leak data or trigger unintended downstream actions in environments where system events are privileged or broadly routed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends job metadata, chat identifier, and a clip URL to an external eventing mechanism without in-code disclosure or consent handling. Even if the destination is local infrastructure, this is a data-sharing behavior that may expose identifiers and media links to other components or operators not necessary for the core rendering function.

Content

No source excerpt is available for this finding.

Tainted flow: 'match_id' from requests.get (line 37, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/leetify/leetify_resolve.py (reported line 39)May include surrounding context.

python
if not replay_url:
        match_id = matches[match_index].get("id")
        if match_id:
            detail = requests.get(
                f"{LEETIFY_API_BASE}/v3/matches/{match_id}",
                headers=headers, timeout=30,
            )

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The module docstring says the script outputs highlight metadata as JSON to stdout and writes progress to state.json, implying limited side effects. In practice, the code also writes highlights via write_highlights(highlights) and triggers an external openclaw system event, so the documentation understates and thereby conflicts with the actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code retrieves an API key and makes HTTP requests to Demo-Slap, and may also call Leetify to resolve a Steam ID, but the script provides no user-facing notice, prompt, or inline warning that external services will be contacted. For code files, network calls that transmit user or system data should have some visible disclosure unless clearly covered by the skill description; in this file, that disclosure is not present.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.