Wake-on-LAN

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.2.0

Overview

This skill does what it claims: it sends Wake-on-LAN packets and optionally saves local device aliases, with no evidence of hidden or unrelated behavior.

Install and run this only if you intend to send Wake-on-LAN packets on your local network. Consider using a virtual environment and pinning the wakeonlan dependency if you need reproducible installs. Saved aliases contain MAC/IP details and are stored locally in the skill directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:37 and SKILL.md:1
Vulnerability Type: Unpinned third-party Python package installation
Risk Level: Medium

Vulnerable code snippets:

README.md:37:

bash

pip install wakeonlan

SKILL.md:1:

bash

pip install wakeonlan

Technical Analysis

The installation instructions retrieve the latest version of the wakeonlan package without specifying a reviewed version or verifying package integrity with cryptographic hashes. Consequently, the installed code can change after this Skill has been audited.

Python package installation may execute package-controlled installation logic, while subsequent use imports or invokes the installed package. If the upstream package, package publisher account, or package distribution channel is compromised, following the documented command could install attacker-controlled code.

No evidence shows that the currently referenced package is malicious. This finding concerns the mutable and unverified dependency acquisition process.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented pip install wakeonlan instruction.
4. pip resolves and downloads the attacker-controlled release because no version or hash is pinned.
5. Malicious package installation or runtime code executes in the user's environment.
6. The resulting access is limited by the privileges of the account or environment running pip or the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installing or executing user. Depending on those privileges, an attacker could access user-readable files, modify user-owned data, use available network access, or compromise the Python environment. ...[truncated 257 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin wakeonlan to a specifically reviewed version rather than installing the latest available release.

2. Place the dependency in a lock or requirements file containing cryptographic hashes, for example:

   text

   wakeonlan==REVIEWED_VERSION --hash=sha256:VERIFIED_DISTRIBUTION_HASH
   

3. Install it with hash verification enabled:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes only from distributions obtained through the intended official package index and verify the package publisher and release provenance.

5. Run dependency vulnerability and provenance checks when updating the pinned version.

6. Install and run the package in a least-privileged virtual environment rather than using an administrative or system account.

7. Update both README.md and SKILL.md so that all documented installation paths use the same locked dependency procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

--- name: wake-on-lan description: "Wake devices on your LAN using Wake-on-LAN magic packets. Supports saved devices (by alias or MAC) and ad-hoc wake commands via CLI or Python. Works on Linux, macOS, and Termux/Android. Use when: (1) waking a sleeping/suspended device, (2) managing WOL device aliases, (3) sending magic packets to specific MAC/IP. 🖥️ emoji = wake desktop." version: 1.2.0 author: kingofqin2026 license: MIT metadata: openclaw: tags: [WOL, wake-on-lan, network, magic-packet, BIOS, wake] --- # Wake-on-LAN (WOL) Send magic packets to wake sleeping/suspended devices on your local network. ## Prerequisites ```bash pip install wakeonlan ``` ## Quick Usage ### Wake by alias (requires device to be saved first) ```bash python3 <skill_dir>/scripts/wol.py <alias> ``` ### Wake by MAC directly ```bash wakeonlan -i <ip> -p <port> <mac> # or python3 <skill_dir>/scripts/wol.py --mac <mac> --ip <ip> [--port <port>] ``` ### Wake via Python ```python from wakeonlan import send_magic_packet send_magic_packet("<mac>", ip_address="<ip>", port=9) ``` ## Managing Saved Devices The script stores device aliases in `references/devices.json`. **No devices are pre-configured** — add yours: ```bash # Add a device python3 <skill_dir>/scripts/wol.py add <alias> --mac <mac> --ip <ip> [--port <port>] # Example python3 <skill_dir>/scripts/wol.py add desktop --mac aa:bb:cc:dd:ee:ff --ip 192.168.1.100 # List saved devices python3 <skill_dir>/scripts/wol.py list # Remove a device python3 <skill_dir>/scripts/wol.py remove <alias> ``` ## How It Works The `wol.py` script sends magic packets via **two methods** for reliability: 1. **`wakeonlan` CLI** — standard tool 2. **Raw UDP sockets** — fallback for environments where CLI fails (e.g. Termux/Android) Both broadcast (`255.255.255.255`) and specific IP are targeted on ports 9 and 7. ## Troubleshooting ### Termux / Android — Known Issue The `wakeonlan` CLI alone may NOT work on Termux — Android's Wi-Fi stack can block broadcast UDP. The `wo
...[truncated 26 chars]

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/wol.py (reported line 43)May include surrounding context.

python

# Method 1: wakeonlan CLI
    cmd = ["wakeonlan", "-i", ip, "-p", str(port), mac]
    print(f"Sending WOL magic packet to {mac} via {ip}:{port}...")
    result = subprocess.run(cmd, capture_output=True, text=True)

    # Method 2: Raw UDP sockets (needed on Termux/Android)
    try:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly instructs users to send network packets and to persist device aliases in references/devices.json, but it does not clearly warn about these side effects up front. While Wake-on-LAN inherently requires network transmission and local state storage, the absence of an explicit side-effect warning can lead to unintended network activity or persistent changes by users who expect read-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.