ClawHub
Back to skill

Security audit

Termux SMS

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear SMS-sending purpose, but its command template can turn user-supplied message text or phone numbers into shell execution if an agent runs it through a shell.

Install only if you trust agents using it to handle SMS carefully. Before use, the command should pass recipient and message as separate process arguments or apply strict recipient validation and robust shell escaping; otherwise, a crafted message could run commands in Termux.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:35
Finding

Shell Command Injection Through Untrusted SMS Arguments

Content
View full analysis
"" ``` ### Technical Analysis The skill instructs the agent to place a user-supplied phone number and message directly into a shell command. Although the message is enclosed in double quotes, double-quoted shell strings still permit expansions such as command substitution using `$(...)` or backticks. An embedded quote may also terminate the intended argument and introduce shell operators. The documented confirmation step does not neutralize shell syntax. If the agent invokes the constructed command through a shell, a message such as `Status: $(malicious-command)` can cause the shell to execute the substituted command before `termux-sms-send` runs. The vulnerability is conditional on the execution mechanism using a shell to interpret the documented command. Passing arguments directly to the executable through a non-shell process API would prevent shell expansion. ### Attack Path 1. An attacker persuades a user or agent to send an SMS containing shell syntax, such as command substitution, or supplies a crafted recipient value containing shell metacharacters. 2. The user confirms the exact recipient and message as required by the skill. Confirmation does not identify or escape shell syntax. 3. The agent substitutes those untrusted values into the documented command. 4. The agent executes the resulting command through a shell. 5. The shell evaluates the injected syntax before launching `termux-sms-send`. 6. The injected command executes with the same operating-system privileges and Termux permissions as the OpenClaw or agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution in the Termux environment under the agent process account. The ...[truncated 512 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.