T09 · Insecure Skill Coding Practices
Error
- Location
bridge/cli.py:246- Finding
Arbitrary Shell Command Execution Through the --execute Option
- Content
View full analysis
- Remediation
View remediation
Security audit
Grok Swarm
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real Grok bridge skill, but it includes under-scoped local command execution and credential reuse behavior that should be reviewed before installation.
Install only if you are comfortable with selected files being sent to OpenRouter/Grok and with local generated-file writes. Avoid using the --execute option, prefer an explicit OPENROUTER_API_KEY or dedicated config key, review the installer dependency line before running it, and do not rely on shared OpenClaw auth profiles unless that reuse is intentional.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
install.sh:53- Finding
Unpinned Dependency Installation and Incorrect Shell Parsing of Version Constraint
- Content
View full analysis
=1.0.0 ``` ### Technical Analysis The package specification is not quoted. Bash interprets the `>` character as an output-redirection operator rather than as part of the Python package version constraint. The effective pip argument is therefore `openai`, while command output is redirected to a file named `=1.0.0` in the installer's current working directory. As a result, the intended minimum-version constraint is not reliably passed to pip. More importantly, pip resolves an unconstrained current package release from the configured package index. The project provides no lockfile, exact version pin, or package hash verification. This exposes installations to future incompatible or compromised releases from the configured dependency source. It also causes an unexpected filesystem side effect by creating or truncating `=1.0.0` in the current directory. ### Attack Path 1. A user executes `install.sh`. 2. Bash parses `>` as output redirection because the package requirement is unquoted. 3. Pip receives an unconstrained `openai` package name rather than the intended `openai>=1.0.0` requirement. 4. Pip selects the latest matching release from its configured package index without hash verification. 5. If that source, package release, resolver configuration, or mirror is compromised, attacker-controlled package code can be installed into the Skill's virtual environment. 6. The malicious dependency code executes when imported or otherwise invoked by the bridge. 7. Separately, the shell creates or truncates a file named `=1.0.0` in the caller's working directory. ### Impact Assessment A compromised dependency could execute with the privileges of the account running the Skill when imported or used. Its ...[truncated 475 chars]- Remediation
View remediation
=1.0.0' ``` 2. Prefer an exact, reviewed dependency version rather than an open-ended minimum: ```bash "$SKILL_DIR/.venv/bin/pip" install -q 'openai==' ``` 3. Maintain dependencies in a lock or requirements file with cryptographic hashes and install with hash enforcement: ```bash "$SKILL_DIR/.venv/bin/pip" install --require-hashes -r requirements.txt ``` 4. Use a trusted, explicitly configured package index and disable unexpected extra indexes. 5. Review and test dependency updates before publishing a new Skill version. 6. Add a shell linter such as ShellCheck to CI; it can help identify parsing and redirection mistakes. 7. Remove any unintended `=1.0.0` file created by previous installer runs. ]]>
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
bridge/grok_bridge.py:82- Finding
Implicit Cross-Agent OpenRouter Credential Discovery and Reuse
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (18)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is a true tool-parameter abuse issue because the CLI accepts a raw
--executestring and forwards it directly tosubprocess.run(..., shell=True). In the context of an agent skill that can write files from model output, chaining generation plus execution creates a dangerous pathway to arbitrary code execution and host compromise.- Content
python # Execute command if requested if args.execute: print(f"\nExecuting: {args.execute}", file=sys.stderr) exec_result = subprocess.run( args.execute, shell=True, capture_output=True,
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python --prompt <text> Task instruction (required) --mode <mode> Task mode: refactor|analyze|code|reason|orchestrate (default: reason) --files <path...> Files to include as context --system <text> Override system prompt (required for orchestrate mode) --tools <path> JSON file with OpenAI-format tool definitions --timeout <secs> Timeout in seconds (default: 120) --output <path> Output file (default: stdout)
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python --prompt <text> Task instruction (required) --mode <mode> Task mode: refactor|analyze|code|reason|orchestrate (default: reason) --files <path...> Files to include as context --system <text> Override system prompt (required for orchestrate mode) --tools <path> JSON file with OpenAI-format tool definitions --timeout <secs> Timeout in seconds (default: 120) --output <path> Output file (default: stdout)
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
js --prompt <text> Task instruction (required) --mode <mode> Task mode: refactor|analyze|code|reason|orchestrate (default: reason) --files <path...> Files to include as context --system <text> Override system prompt (required for orchestrate mode) --tools <path> JSON file with OpenAI-format tool definitions --timeout <secs> Timeout in seconds (default: 120) --output <path> Output file (default: stdout)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly advertises direct file writing capabilities but does not warn users that invoking the skill may modify files on disk. In an agent context, silent write capability increases the risk of unintended code changes, overwrites, or persistence of generated content without clear user consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
The documentation instructs users to persist an API key in
~/.config/grok-swarm/config.json, creating long-lived local credential storage. Persistent secrets increase exposure if the workstation is compromised, backups are shared, or the file is accidentally included in sync, logs, or source control.- Content
export OPENROUTER_API_KEY=sk-or-v1-...
text Or create `~/.config/grok-swarm/config.json`: ```bash mkdir -p ~/.config/grok-swarm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/.config/grok-swarm echo '{"api_key": "sk-or-v1-..."}' > ~/.config/grok-swarm/config.json chmod 600 ~/.config/grok-swarm/config.jsonInstallation
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_morph_available(): """Check if Morph LLM MCP is installed.""" try: result = subprocess.run( ["claude", "mcp", "list"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Execute via claude mcp try: result = subprocess.run( ["claude", "mcp", "call", "morphllm", "edit_file", "--file", validated_path, "--code", block["code"],
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The code executes
args.executewithshell=True, which allows arbitrary shell command execution. In a skill that already generates and applies LLM-produced content, this is especially dangerous because a user or downstream automation could pass untrusted or model-influenced commands and gain full code execution on the host.- Content
python # Execute command if requested if args.execute: print(f"\nExecuting: {args.execute}", file=sys.stderr) exec_result = subprocess.run( args.execute, shell=True, capture_output=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code reads API credentials from environment variables and multiple local auth/config files, but there is no user-facing disclosure in the CLI help, printed logs, or surrounding comments that the skill will inspect sensitive credential locations. Because this is a code file and the operation accesses secrets, it should include an explicit warning or disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The bridge reads arbitrary local files, concatenates their contents, and appends them to the system prompt before sending them to a third-party remote API. That creates a real confidentiality risk because sensitive source code, secrets, tokens, or proprietary data may be exfiltrated off-host without any explicit consent gate, filtering, or warning beyond normal CLI usage.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
The installer copies a plugin manifest and bridge files into persistent OpenClaw extension/skill directories under ~/.openclaw, causing code and configuration to survive beyond the install session. In the context of an agent skill, persistence is security-relevant because it registers functionality that may later be enabled and executed by the host platform, even though this script openly discloses that behavior.
- Content
sh # Install plugin log "Installing OpenClaw plugin..." PLUGIN_DIR="$OPENCLAW_HOME/extensions/grok-swarm" mkdir -p "$PLUGIN_DIR" if [ -f "$SCRIPT_DIR/openclaw.plugin.json" ]; then cp "$SCRIPT_DIR/openclaw.plugin.json" "$PLUGIN_DIR/" log "Plugin manifest installed"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This shell script creates directories and copies files into ~/.openclaw and ~/.config, and also creates a config.json file. Although it logs what it is doing, there is no confirmation prompt or explicit pre-action warning before these filesystem changes, which are safety-relevant install-time modifications to user data locations.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh mkdir -p "$CONFIG_DIR" if [ ! -f "$CONFIG_DIR/config.json" ]; then echo '{"api_key": ""}' > "$CONFIG_DIR/config.json" chmod 600 "$CONFIG_DIR/config.json" warn "Created $CONFIG_DIR/config.json — add your OpenRouter API key" fi
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The API key setup instructions tell users to store credentials in an environment variable or local config file without warning about secret handling risks. While common practice, omitting guidance on avoiding shell history exposure, securing file permissions, and not committing config files can lead to accidental credential disclosure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The script can write the model output to a specified output file and, with --write-files, create multiple files on disk from annotated response blocks. Although filenames written are reported afterward, there is no prior warning in the help text or inline disclosure that enabling these options will create or overwrite local files.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The inline comment says 'CLI invocations bypass this wrapper via src/plugin/index.ts', yet the code in this file is explicitly a command-line wrapper that parses CLI arguments and passes them to the Python bridge. That is an active contradiction in the local documentation about how this wrapper is used, even though it is not a high-severity security issue.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bridge/index.js:153