T09 · Insecure Skill Coding Practices
Warning
- Location
drawing_tool.py:142- Finding
Caller-Controlled Output Path Allows Arbitrary File Overwrite in drawing_tool.py
- Content
View full analysis
- Remediation
View remediation
Security audit
Scientific Drawing
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real scientific drawing skill, but its Python helpers can write generated images to fixed or caller-controlled filesystem paths without enough containment.
Install only if you are comfortable with a drawing helper that writes local files. Prefer running it in a workspace or sandbox, and avoid passing paths or filenames from untrusted text until output paths are validated and made configurable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
drawing_tool_v2.py:128- Finding
Caller-Controlled Output Path Allows Arbitrary File Overwrite in drawing_tool_v2.py
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
This is a true security-relevant mismatch because the skill claims benign drawing behavior while implicitly directing writes to a fixed absolute path on the host. Even if the rest of the discrepancy is primarily quality-related, undocumented local file writes expand the skill's effective privileges and can cause unauthorized persistence, overwrite risk, or execution failures in different environments.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This is a true security-relevant mismatch because the skill claims benign drawing behavior while implicitly directing writes to a fixed absolute path on the host. Even if the rest of the discrepancy is primarily quality-related, undocumented local file writes expand the skill's effective privileges and can cause unauthorized persistence, overwrite risk, or execution failures in different environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as a Chinese-language tool, without indicating that other languages are supported or that the user can choose a locale. This matches the policy concern for language or locale constraints imposed without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The usage instructions tell users to interact with the skill using Chinese prompts and do not offer any alternative language or opt-in mechanism. Because the file repeatedly frames operation in a single language without documenting choice or necessity, it creates a natural-language locale policy issue.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code hard-codes OUTPUT_DIR to a specific personal Windows path and creates it automatically at import time. This causes unprompted writes to a fixed filesystem location outside the current working directory, which is unsafe for a reusable skill because it can overwrite files, leak artifacts into unintended locations, and break isolation assumptions in shared or sandboxed environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code writes outputs to a hard-coded personal filesystem path (
D:/Personal/OpenClaw/figures) instead of using a caller-supplied or sandboxed location. In an agent/skill context, this can cause unintended file writes, overwrite data, leak environment details, and break containment assumptions when the skill is executed on a host with broader filesystem access.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module description is written in Chinese and the code explicitly configures Chinese fonts, which signals a language-specific experience. There is no indication that users may opt into another language or that the locale restriction is documented as intentional and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script silently creates a directory and writes image files to a fixed path without user confirmation or any visibility into where data is being stored. In an agent or automation context, this can produce unexpected persistence on the host filesystem and may expose generated content to other local users or processes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The module docstring and comments present the tool as Chinese-language only, but the file does not indicate that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The embedded demo runner automatically creates multiple files when the script is executed directly, which introduces side effects beyond the core drawing API. In a skill environment, unexpected file generation increases the risk of unrequested writes, resource consumption, and misuse if the file is invoked as an executable rather than imported as a library.
- Content