T09 · Insecure Skill Coding Practices
Warning
- Location
lib/engine.js:6- Finding
Chromium Security Sandbox Disabled During Authenticated Browser Automation
- Content
View full analysis
- Remediation
View remediation
Security audit
Gv Caller
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly built to place Google Voice calls, but it can use stored Google session cookies and dial automatically from broad natural-language triggers without a clear confirmation step.
Review before installing. Only use this in a contained, unprivileged environment with a dedicated Google Voice account, explicit per-call confirmation, narrow invocation phrasing, protected cookie storage, private temporary directories, and clear legal approval for every destination and message.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
bin/call.sh:15- Finding
Predictable Shared Temporary Files and Cross-Invocation TTS Selection
- Content
View full analysis
/dev/null LATEST_MP3=$(ls -t /tmp/openclaw/tts-*/voice-*.mp3 | head -n 1) ffmpeg -i "$LATEST_MP3" -ar 44100 -ac 1 "$AUDIO_PATH" -y > /dev/null 2>&1 fi ``` From `lib/engine.js:55`: ```javascript await page.screenshot({ path: '/tmp/call_result.png' }); ``` ### Technical Analysis The generated WAV filename uses Bash `$RANDOM`, which has a small and predictable namespace and does not atomically create a private file. The path is placed in the globally shared `/tmp` directory, and `ffmpeg` is instructed to overwrite an existing path using `-y`. This creates a race window in which another local process can pre-create or replace the destination, including with a symbolic link. The TTS source is not tied to the output of the current `openclaw tts` invocation. Instead, the script searches a global wildcard and selects whichever matching MP3 has the most recent modification time: ```bash LATEST_MP3=$(ls -t /tmp/openclaw/tts-*/voice-*.mp3 | head -n 1) ``` Concurrent invocations can therefore select another request's audio. A local attacker who can create or modify matching entries under the searched path may also influence which content is injected into the call. The call screenshot is always written to `/tmp/call_result.png`, creating another shared, fixed destination. Concurrent invocations can overwrite each other's evidence, while a local attacker may attempt to race or redirect the destination. ### Attack Path #### Audio substitution or cross-call disclosure 1. Two calls execute concurrently, or a local attacker can create files under a matching `/tmp/openclaw/tts-*` location. 2 ...[truncated 2100 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises simple Google Voice calling, but the documented behavior also relies on sensitive cookie reuse, local file access, browser automation, and simulated microphone/audio injection. This mismatch reduces informed consent and hides high-risk capabilities that could enable unauthorized account use, exfiltration of authentication state, or deceptive robocalling if the skill is invoked unexpectedly.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The invocation phrases are broad enough to match common conversational language such as 'call' or generic Chinese phrases for placing a call. In an agent environment, this raises the chance of accidental activation leading to real outbound phone calls, possible charges, and unintended disclosure of spoken content to third parties.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill automatically initiates an outbound phone call after typing a target number and clicking the call button, with no confirmation gate, allowlist, rate limit, or safety interlock. In the context of an automation skill designed to place calls and inject audio, this is particularly dangerous because it can be abused for robocalling, harassment, spam, or unauthorized communication at scale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest description is written only in Chinese, and the documented invocation examples are predominantly Chinese-language commands, with no statement that users may choose another language. This can conflict with a language/locale policy requiring user choice unless the locale restriction is explicitly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language trigger description says a user can simply tell the agent to call someone and relay a message, but it does not clearly define activation boundaries or safeguards. That ambiguity makes it easier for ordinary chat text to be interpreted as a command, especially dangerous here because the resulting action is a real phone call with synthesized or injected audio.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description promises two delivery modes: AI-generated speech (TTS) or local audio. In this file, the implementation launches Chromium with --use-file-for-fake-audio-capture to feed an existing audio file into the call, but there is no code to generate TTS or invoke any TTS service/library. That is a semantic mismatch between the claimed capability and the implemented behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
User-facing log messages and UI matching strings are written only in Chinese, and the selector logic depends on Chinese text such as “输入姓名或电话号码” and “呼叫”. This imposes a single language/locale without offering the user a choice or documenting the locale requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Accessing persisted authentication cookies without clear user-facing disclosure or confirmation is dangerous because it silently reuses an authenticated Google Voice session. In this skill's context, that directly enables account actions—placing calls—under another user's identity or billing/account footprint without transparent consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The line describes adding Chinese detailed documentation and feature introductions, which may imply a language-specific documentation policy without any opt-in or multilingual alternative. Under the stated policy, forced language or locale constraints in natural-language content can be a violation when no user choice or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
When --text is provided, the script generates speech output and writes a WAV file under /tmp, then processes it with ffmpeg. This is a file-creating operation, but the script provides no confirmation, logging, or explanatory comment that user-supplied text will be converted and stored on disk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script executes external tools (openclaw and ffmpeg) to process user input, but it does so silently by redirecting output to /dev/null. For code files, subprocess execution that lacks any confirmation, logging, or documentation can be a missing user warning unless clearly disclosed elsewhere.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The inline comment uses Chinese ('执行引擎') without indicating that the skill supports multiple languages or that a non-English locale is intentional. The policy flags language choices that are imposed without user opt-in or clear justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code reads persistent Google Voice authentication cookies from a fixed workspace path, enabling use of an existing authenticated account without an explicit authentication flow or scoped consent at runtime. In the context of a calling skill, this increases risk because anyone able to invoke the skill may place calls using the stored account, and the cookie file becomes a sensitive secret target.
- Content