T09 · Insecure Skill Coding Practices
Error
- Location
scripts/preview.sh:11- Finding
Broken credential redaction in configuration preview
- Content
View full analysis
- Remediation
View remediation
Security audit
Safe Config Modifier
Security checks for vulnerabilities and agentic risk
Overview
Review recommended: the skill is meant to safely edit OpenClaw settings, but its redaction scripts can leave real API keys visible in previews.
Install only after reviewing the scripts and do not trust this skill’s preview output to hide secrets. Avoid pasting generated previews into chats, tickets, or logs unless you independently scrub credentials. Treat config edits, gateway restarts, and provider connectivity tests as manual actions that should require clear confirmation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sanitize.sh:1- Finding
Standalone sanitizer fails to redact most documented secret fields
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明的核心目的是“安全修改” OpenClaw 配置文件，并明确包含修改前备份、脱敏预览和用户确认等步骤。但提供的代码片段是一个 preview.sh 脚本，只读取配置文件并输出摘要与脱敏后的完整内容，没有任何写回配置、创建备份、交互确认或应用变更的逻辑。因此其实际行为仅覆盖了声明中的“预览（脱敏 key）”这一部分，且主功能与声明的主功能存在实质偏差。虽然代码访问的资源（OpenClaw 配置文件）与声明一致，也没有明显越权能力，但整体仍属于描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个“安全修改 OpenClaw 配置文件”的技能，核心能力应包括修改配置文件本身，并在修改前完成备份、脱敏预览和用户确认。实际提供的代码只是一个独立的 sanitize.sh 脚本：它对输入文本中的 apiKey、token、password、secret 等字段做脱敏替换。该行为只对应声明中的“预览（脱敏 key）”这一辅助环节，而且连预览展示逻辑、文件读取/写回、备份、确认都没有实现。因此代码实际主功能与声明的主要用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“安全修改” OpenClaw 配置文件，并强调修改流程中的备份、预览和确认控制。但提供的代码仅实现了只读验证：读取配置文件，使用 jq 做语法与字段检查，并打印部分配置信息。其主要目的与声明不一致，属于功能性失配。虽然代码访问的资源（openclaw.json）与声明相关，但实际行为缺少声明中的关键修改能力和安全流程。
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Requiring a single Chinese-only confirmation phrase creates an unsafe confirmation workflow because users may not understand what authorizes the action, while agents may overfit to a magic string rather than actual informed consent. Security confirmations should be clear, accessible, and semantically tied to the pending action, not dependent on locale-specific wording.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is written as a directive in Chinese and the skill later requires a Chinese confirmation phrase, but nowhere offers the user a language choice or opt-in. This creates a locale-specific interaction policy that may exclude users who operate in other languages.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs operators to perform an outbound network request to a third-party API as part of local config editing validation, which is outside the minimum required scope. Even though the example uses a test bearer value, normalizing unnecessary external connectivity in a config-editing skill can leak environment metadata, create unwanted egress, and blur trust boundaries.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The documented curl command initiates an external request to a third-party API from within a skill intended for local configuration safety. Any unnecessary egress is sensitive in a security context because it can expose IP, timing, user environment details, or be repurposed later with real credentials if operators imitate the pattern.
- Content
~/.openclaw/skills/safe-config/scripts/validate.sh
测试 API 连通性（如适用）
curl -s https://api.siliconflow.cn/v1/models -H "Authorization: Bearer test" | jq .
text ### 步骤 3: 请求用户确认
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Restarting and managing the OpenClaw gateway extends the skill from safe file editing into runtime service control. This broadens blast radius: a mistaken or malicious use could disrupt service availability or apply unreviewed changes immediately after editing.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "models": { "providers": { "anthropic": { "baseUrl": "https://api.anthropic.com/v1", "apiKey": "sk-ant-***", "models": [ {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing natural-language fields are entirely in Chinese, including the required confirmation phrase "只认 ojbk可以改了", with no indication that other languages are supported or optional. This creates a language/locale policy issue because the skill appears to require a specific language for use without offering user choice or documenting a justified locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples show secrets such as apiKey, botToken, and bridge token directly in configuration snippets without any adjacent guidance on secret handling, redaction, or use of environment-backed placeholders. In a skill specifically designed to modify ~/.openclaw/openclaw.json, this increases the chance users will paste real credentials into configs, screenshots, chat logs, or version control, leading to credential leakage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script prints the full configuration file after applying a narrow regex-based redaction pass, which is not a reliable way to remove all secrets from arbitrary JSON. Keys with different names, nested structures, multiline values, or formatting variations may remain visible, exposing credentials in terminal logs, scrollback, screenshots, or shared sessions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The sed expression is malformed for the stated purpose: only the final alternation includes the colon, so keys like "apiKey", "token", "password", and "secret" will not match normal JSON key/value pairs and therefore will not be redacted. In a skill explicitly intended to safely modify and preview ~/.openclaw/openclaw.json with secrets masked, this can leak credentials during preview, logging, or user confirmation flows.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a file-modification workflow centered on
~/.openclaw/openclaw.json, butopenclaw gateway statusintroduces runtime service inspection. That operational capability is not required to safely edit, back up, preview, or validate the config file itself.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file's headings and instructions are entirely in Chinese, which can constitute a language policy issue when a specific language is effectively forced without user opt-in or justification. No alternative locale, opt-in, or scope limitation is provided in the document itself.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing comments and output strings in the script are written in Chinese, which effectively fixes the skill's interface language without any opt-in or explanation. Under the language/locale policy, this is a natural-language constraint that should either be optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script presents all user-facing messages and usage comments in Chinese only, including errors and status output. That imposes a specific language without opt-in or any documented justification, which matches the language/locale policy violation category.
- Content
Static analysis
No suspicious patterns detected.