Security audit

Ruby On Rails Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned and read-only, but it asks agents to pass Rails gateway credentials to an unaudited local helper and can pull sensitive app data broadly.

Install only if you are comfortable granting the agent read access to the configured Rails gateway data. Prefer direct curl or a verified, trusted helper; avoid running the absolute-path helper unless you know its source and contents. Use least-scope resources and periods, avoid period=all unless needed, and keep both bearer tokens and secret-bearing URLs out of logs, shell history, and shared output.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

Location: skill.md:55
Finding: Execution of an Unverified External Helper with Gateway Credentials
Content: View full analysis
/briefing' \ RAILS_GATEWAY_TOKEN='***' \ /home/node/.openclaw/workspace/scripts/rails-gateway-briefing --period 7d --resources users,orders ``` ``` The same external helper is invoked in `references/usage.md`, including daily, weekly, and full-history pull profiles. ### Technical Analysis The Skill recommends executing `/home/node/.openclaw/workspace/scripts/rails-gateway-briefing`, but that executable is outside the audited Skill package. The instructions only recommend checking that the file exists and is executable; they do not require verification of its contents, owner, permissions, source, signature, or cryptographic digest. The helper may receive `RAILS_GATEWAY_URL` and `RAILS_GATEWAY_TOKEN`. The URL can contain the path secret, while the token is the second authentication factor. Consequently, a spoofed or replaced helper could access both credentials. Because the helper executes as a local process, it could also perform arbitrary actions with the operating-system privileges of the Agent process. This does not establish that the referenced helper is malicious. The risk arises because its trustworthiness cannot be established from the audited package, and an attacker with write access to that path could substitute attacker-controlled logic. ### Attack Path 1. An attacker gains the ability to create or modify `/home/node/.openclaw/workspace/scripts/rails-gateway-briefing`. 2. The attacker replaces the expected helper with a malicious executable while ...[truncated 1083 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: skill.md:48
Finding: Gateway Path Secret Exposed Through Request URLs
Content: View full analysis
/briefing`). Wrong value returns **404** (endpoint appears nonexistent). 2. **Bearer token** — sent via `Authorization` header. Wrong/missing value returns **401**. ``` From `skill.md`, lines 48–52: ```bash curl -H "Authorization: Bearer $AGENT_GATEWAY_TOKEN" \ "https://myapp.com/agent-gateway/$AGENT_GATEWAY_SECRET/briefing?period=7d&resources=users,orders" ``` The minimal health check in `references/usage.md`, lines 5–8, uses the same URL structure: ```bash curl -H "Authorization: Bearer $AGENT_GATEWAY_TOKEN" \ "https://myapp.com/agent-gateway/$AGENT_GATEWAY_SECRET/briefing?period=7d&resources=users&latest=1" ``` ### Technical Analysis The gateway's path secret is interpolated directly into the request URL. Although HTTPS encrypts the URL while it travels over the network, it does not prevent the URL from being exposed through local process listings, shell tracing, command history, reverse-proxy access logs, application logs, observability platforms, error reports, or monitoring infrastructure. The design uses two authentication factors: the path secret and a bearer token. Disclosure of the path secret alone therefore does not ordinarily authorize a request. Nevertheless, it weakens the two-layer control and makes a later or independent bearer-token disclosure sufficient for complete authentication. The network transmission itself is necessary for the Skill's declared briefing functionality. The excessive risk is specifically the placement of authentication material in the URL rather than in a protected authorization header. ### Attack Path 1. The Agent performs the documented `curl` request with `AGENT_GATEWAY_SECRET` ...[truncated 1186 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file includes curl and helper-script examples that transmit authentication credentials and fetch application data, including recent user records with email and name fields. The usage reference does not include any warning or disclosure about handling sensitive data, privacy implications, or ensuring authorization before running these commands.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.