T09 · Insecure Skill Coding Practices
Error
- Location
crabpath/split.py:397- Finding
Workspace Symlink Boundary Bypass Can Expose Files to OpenAI
- Content
View full analysis
- Remediation
View remediation
Security audit
CrabPath
Security checks for vulnerabilities and agentic risk
Overview
CrabPath is a coherent memory-graph skill, but its workspace indexing and rebuild flows can expose or overwrite more local data than users would reasonably expect if paths are not tightly controlled.
Install only if you are comfortable with a persistent local memory graph over selected workspaces and optional transmission of indexed text to OpenAI. Use trusted, non-shared workspace directories, avoid indexing untrusted repositories or symlinks, prefer hash/offline mode for sensitive data, and do not run the OpenClaw rebuild scripts as a privileged account until path containment and private cache handling are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/openclaw_adapter/rebuild_all_brains.py:34- Finding
Predictable Shared Temporary Cache Allows Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (98)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 90% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md ### Fix: save_state() embedder metadata preservation - Now reads existing meta before writing; no more silent hash-v1/1024 overwrite - Dimension mismatch raises ValueError (prevents corrupt state) - Fixes GitHub Issue #1 item #7 (CormorantAI production data corruption) ### Fix: Rebuild preserves injected nodes
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analyzer indicates direct access to local workspaces, logs, caches, SQLite databases, backup/rebuild workflows, and subprocess execution, all of which are far outside a pure memory-core claim. This can create serious integrity and confidentiality risks if administrators deploy the skill assuming limited behavior.
- Content
Static analysis
No suspicious patterns detected.