T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:40- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Local Self-Healing Machine Learning
Security checks for vulnerabilities and agentic risk
Overview
The skill is broadly a self-healing coding agent, but it gives an automated code-changing agent broad private workspace context and has under-disclosed network and dashboard risks.
Install only if you are comfortable with an autonomous local agent reading broad OpenClaw session and memory data and using it to drive repository changes. Prefer running with EVOLVE_BRIDGE=false or --review, set a narrow EVOLVER_SESSION_SCOPE, avoid non-loopback OLLAMA_URL values, do not expose the dashboard beyond localhost, and avoid the curl-to-shell Ollama install path unless you independently trust and verify it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
src/evolve.js:1537- Finding
Untrusted Session and Memory Content Is Injected into an Autonomous Code-Modifying Agent Prompt
- Content
View full analysis
sub-agent via sessions_spawn. // This project is the Brain; the Hand is a spawned executor agent. Wrappers can disable bridging with EVOLVE_BRIDGE=false. if (bridgeEnabled) { ... const executorTask = [ 'You are the executor (the Hand).', 'Your job is to apply a safe, minimal patch in this repo following the attached GEP protocol prompt.', artifact && artifact.promptPath ? `Prompt file: ${artifact.promptPath}` : 'Prompt file: (unavailable)', '', 'After applying changes and validations, you MUST run:', ' node index.js solidify', '', 'Loop chaining (only if you are running in loop mode): after solidify succeeds, print a sessions_spawn call to start the next loop run with a short delay.', 'Example:', 'sessions_spawn({ task: "exec: node skills/feishu-evolver-wrapper/lifecycle.js ensure", agentId: "main", cleanup: "delete", label: "gep_loop_next" })', '', 'GEP protocol prompt (may be truncated here; prefer the prompt file if provided):', clip(prompt, 24000), ].join('\n'); const spawn = renderSessionsSpawnCall({ task: executorTask, agentId: AGENT_NAME, cleanup: 'delete', label: `gep_bridge_${cycleN ...[truncated 2497 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/evolve.js:150- Finding
Default Evolution Run Reads Broad Cross-Session Workspace Data Beyond Minimum Necessary Scope
- Content
View full analysis
f.endsWith('.jsonl') && !f.includes('.lock')) .map(f => { try { const st = fs.statSync(path.join(AGENT_SESSIONS_DIR, f)); return { name: f, time: st.mtime.getTime(), size: st.size }; } catch (e) { return null; } }) .filter(f => f && (now - f.time) < ACTIVE_WINDOW_MS) .sort((a, b) => b.time - a.time); ``` ```js if (sessionScope && nonEvolverFiles.length > 0) { const scopeLower = sessionScope.toLowerCase(); const scopedFiles = nonEvolverFiles.filter(f => f.name.toLowerCase().includes(scopeLower)); if (scopedFiles.length > 0) { nonEvolverFiles = scopedFiles; console.log(`[SessionScope] Filtered to ${scopedFiles.length} session(s) matching scope "${sessionScope}".`); } else { console.log(`[SessionScope] No sessions match scope "${sessionScope}". Using all ${nonEvolverFiles.length} session(s) (fallback).`); } } const activeFiles = nonEvolverFiles.length > 0 ? nonEvolverFiles : files.slice(0, 1); // Read from multiple active sessions (up to 6) to get a full picture const maxSessions = Math.min(activeFiles.length, 6); ``` ```js const WORKSPACE_ROOT = process.env.OPENCLAW_WORKSPACE || path.resolve(REPO_ROOT, '../..'); const ROOT_MEMORY = path.join(WORKSPACE_ROOT, 'MEMORY.md'); const DIR_MEMORY = path.join(MEMORY_DIR, 'MEMORY.md'); const MEMORY_FILE = fs.existsSync(ROOT_MEMORY) ? ROOT_MEMORY : (fs.existsSync(DIR_MEMORY) ? DIR_MEMORY : ROOT_MEMORY); const USER_FILE = path.join(WORKSPACE_ROOT, 'USER.md'); ``` ```js function readUserSnippet() { try { if (!fs.existsSync(USER_FILE)) return '[USER.md MISSING]'; return fs.readFileSync(USER_FILE, 'utf8'); } catch ...[truncated 1963 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/ml/embeddings.js:9- Finding
Configurable Ollama Endpoint Can Receive Raw Error Text over Unauthenticated HTTP
- Content
View full analysis
{ const url = new URL('/api/tags', OLLAMA_URL); const req = http.get(url, { timeout: 5000 }, (res) => { let data = ''; res.on('data', d => data += d); res.on('end', () => { _ollamaAvailable = res.statusCode === 200; resolve(_ollamaAvailable); }); }); req.on('error', () => { _ollamaAvailable = false; resolve(false); }); req.on('timeout', () => { req.destroy(); _ollamaAvailable = false; resolve(false); }); }); } ``` ```js async function embedText(text) { const t = String(text || '').trim(); if (!t) return null; const hash = textHash(t); const cache = loadCache(); if (cache[hash]) return new Float64Array(cache[hash]); const available = await isOllamaAvailable(); if (!available) return null; return new Promise((resolve) => { const url = new URL('/api/embeddings', OLLAMA_URL); const body = JSON.stringify({ model: OLLAMA_MODEL, prompt: t }); const req = http.request(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, timeout: REQUEST_TIMEOUT_MS, }, (res) => { let data = ''; res.on('data', d => data += d); res.on('end', () => { try { const ...[truncated 2530 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dashboard/server.js:36- Finding
Unauthenticated Dashboard Binds Without a Loopback Restriction and Exposes Evolution Data with Wildcard CORS
- Content
View full analysis
{ if (req.method === 'GET' && req.url === '/api/data') { res.writeHead(200, ...[truncated 2657 chars]- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (173)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Gene application**: Runs `node`, `npm test`, and project-specific build commands. All execution is sandboxed to the project directory. - **Self-repair** (`src/ops/self_repair.js`): Can abort stale git operations and remove stale lock files. Hard reset (`git reset --hard`) requires `EVOLVE_GIT_RESET=true` AND a clean working tree — it refuses to run if uncommitted changes exist. - **INTEGRATION_STATUS_CMD**: Removed. Previously allowed arbitrary shell
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description repeatedly assures users the skill is fully local, does not reveal machine identity, and exposes no security holes, but the documented behavior includes a dashboard server, persistent data collection, optional external/local HTTP interaction, and even self-modification controls. This mismatch is dangerous because users may grant trust and deploy the skill under false assumptions, enabling broader access and data exposure than advertised.
- Content