ClawHub
Back to skill

Security audit

lazarillo

Security checks across malware telemetry and agentic risk

Overview

This is a coherent assistive messaging skill with disclosed shell, contact-file, and logging behavior, though some safeguards depend on the agent following the skill instructions.

Install only if you are comfortable granting the agent authority to send WhatsApp messages through OpenClaw after confirmation. Configure the private contacts, media, mode, and log paths carefully, keep the audit log protected, and do not rely on this skill as a hard security boundary against a compromised or disobedient agent.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'REG' from os.environ.get (line 16, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
os.makedirs(os.path.dirname(REG), exist_ok=True)
    try:
        import fcntl
        with open(REG, "a", encoding="utf-8") as fh:
            fcntl.flock(fh, fcntl.LOCK_EX)
            fh.write(json.dumps(evento, ensure_ascii=False) + "\n")
            fh.flush()
Confidence
87% confidence
Finding
The log file path ultimately depends on LAZARILLO_BASE from the environment, so an attacker who can influence the process environment can redirect audit writes to an arbitrary filesystem location. In this skill, the audit log is security-relevant because failed logging blocks sends and post-send logging affects delivery semantics, so path redirection can be used for denial of service or tampering with audit records.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to execute a shell command (`python3 scripts/enviar.py ... 2>&1`), read from local files (`memory/contactos.md`), and write logs via the script, yet the skill declares no permissions. That creates a dangerous capability mismatch: an agent/runtime may grant or simulate powerful operations without explicit review, and this skill handles sensitive messaging actions on behalf of a low-vision user who cannot visually verify outcomes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared description says the skill sends confirmed messages, reads documents/email, and drafts text, but the repository behavior reportedly also includes unrelated privacy audit/publication functionality while lacking implementation for several advertised features. This mismatch undermines trust and reviewability: hidden or undeclared behavior is a classic way risky functionality evades scrutiny, especially in a skill that may process private communications and local data.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The README makes strong safety guarantees such as 'No manda nada sin confirmación hablada. Nunca' but later admits that key behavior like 'cualquier mensaje frena el envío' and 'el silencio nunca manda' is only described in the skill and obeyed by the model, with no mechanism enforcing it. In this skill's context, that discrepancy is especially dangerous because the user cannot reliably verify the screen and depends on the agent's spoken description, so a prompt failure or compromised agent could send messages without the promised confirmation barrier.

Unvalidated Output Injection

High
Category
Output Handling
Content
if a.dry_run:
        cmd.append("--dry-run")
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=TIMEOUT_ENVIO)
        rc, salida = r.returncode, (r.stdout + r.stderr).strip()
    except subprocess.TimeoutExpired:
        rc, salida = 124, f"se colgo mas de {TIMEOUT_ENVIO} segundos"
Confidence
65% confidence
Finding
Although shell injection is avoided, untrusted text is forwarded to an external CLI without an explicit option terminator. If the downstream 'openclaw' command treats message bodies beginning with '-' as additional flags, user-controlled content could alter send behavior or target handling; in a messaging skill, that could bypass intended safety assumptions or cause misdelivery.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.