T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:137- Finding
Unredacted High-Risk Tool Inputs and Outputs Are Transmitted Remotely by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent with its stated governance purpose, but it sends sensitive tool inputs and output snippets to a remote service by default and has a policy-enforcement gap that needs review.
Install only if you trust the Kevros gateway with high-risk tool inputs and short output excerpts. Set an explicit API key and pseudonymous agentId, disable autoAttest unless you need remote provenance, avoid putting secrets in governed tool calls, and do not rely on CLAMP constraints until the plugin applies constrained actions or blocks them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:166- Finding
CLAMP Decisions Execute the Original Unconstrained Tool Input
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/client.ts:175- Finding
Unrestricted Gateway URL Can Redirect Sensitive Payloads and API Credentials
- Content
View full analysis
( path: string, body: Record, auth: boolean = true, ): Promise { const headers: Record = { "Content-Type": "application/json", }; if (auth && this.apiKey) { headers["X-API-Key"] = this.apiKey; } const url = `${this.baseUrl}${path}`; const res = await this.fetchWithTimeout(url, { method: "POST", headers, body: JSON.stringify(body), }); ``` ### Technical Analysis The configured `gatewayUrl` is only stripped of a trailing slash. It is not parsed or validated, and the implementation does not require HTTPS or constrain the destination to an approved origin. For authenticated calls, the same API key is placed in the `X-API-Key` header regardless of the configured host. Complete governance payloads are also sent to that destination. An attacker capable of modifying plugin configuration can therefore redirect both sensitive action data and the gateway credential to an attacker-controlled server. A plaintext HTTP URL can additionally expose this information to network interception. Because the remote response controls ALLOW, CLAMP, and DENY decisions, a malicious destination can also return arbitrary governance decisions. ### Attack Path 1. An attacker, compromised deployment process, or untrusted configuration source changes `gatewayUrl`. 2. The replacement URL points to an attacker-controlled host or a plaintext HTTP servi ...[truncated 900 chars]- Remediation
View remediation
other
Note
- Location
src/config.ts:70- Finding
Implicit Signup Discloses the Machine Hostname as a Persistent Agent Identifier
- Content
View full analysis
{ const res = await this.post("/signup", { agent_id: agentId ?? this.agentId, }, /* auth */ false); this.apiKey = res.api_key; return res; } ``` ```ts private async ensureApiKey(): Promise { if (this.hasApiKey) return; await this.signup(); } ``` ### Technical Analysis When no explicit agent identifier is configured, the plugin uses the operating-system hostname. When no API key is configured, the first governed operation automatically invokes `/signup` and sends that hostname as `agent_id`. The behavior is documented, but no dedicated runtime consent step is required. Hostnames can expose organization names, employee identifiers, environment classifications, geographic information, or internal asset naming conventions. They also provide a stable identifier that can link governance events to a particular machine. ### Attack Path 1. The plugin is installed without an explicit `apiKey` or `agentId`. 2. Configuration resolution reads the machine hostname. 3. An agent invokes a configured high-risk tool or the verification tool. 4. `ensureApiKey()` automatically invokes `signup()`. 5. The hostname-derived identifier is sent to the remote `/signup` ...[truncated 449 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
When a high-risk tool is called:
text Agent calls bash("rm -rf /tmp/data") | v before_tool_call hook fires
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
When a high-risk tool is called:
text Agent calls bash("rm -rf /tmp/data") | v before_tool_call hook fires
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
When a high-risk tool is called:
text Agent calls bash("rm -rf /tmp/data") | v before_tool_call hook fires
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
When a high-risk tool is called:
text Agent calls bash("rm -rf /tmp/data") | v before_tool_call hook fires
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
When a high-risk tool is called:
text Agent calls bash("rm -rf /tmp/data") | v before_tool_call hook fires
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md v POST /governance/verify action_type: "tool:bash" action_payload: { tool: "bash", input: { command: "rm -rf /tmp/data" } } | v Gateway returns: { decision: "ALLOW", release_token: "abc123...", epoch: 42 }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md **GET /governance/delegations/{agent_id}** — list active delegations for an agent. **DELETE /governance/delegations/{delegation_id}** — revoke an active delegation. ## Reversibility Check
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explains that tool calls are sent to a governance gateway for verification and attestation, including action payloads and output summaries, but it does not clearly warn that potentially sensitive commands, inputs, outputs, and agent identifiers may be transmitted to a third-party service. In a security-sensitive agent skill, this omission increases the risk of accidental data exposure and policy bypass through uninformed deployment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that if no API key is configured, the plugin will automatically call a remote /signup endpoint on first use, but it does not prominently warn users that installing or running the plugin may trigger an outbound network request and remote account provisioning. In an agent/plugin context, silent network enrollment can violate operator expectations, create unreviewed trust relationships, and leak environment-derived metadata such as agent identifiers or host information.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly describes network-capable behavior and external API interactions, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege failure: an agent or operator may enable the skill without understanding that it can transmit tool inputs and output summaries to a third-party service, increasing the risk of unintended data exfiltration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill instructs users to send data to an external service and elsewhere states that tool names, full input payloads, and truncated output summaries are transmitted to the Kevros gateway. Even though the documentation is relatively transparent, this is still a genuine external transmission risk because sensitive prompts, secrets, operational metadata, or tool outputs could be exposed to a third party, especially with automatic signup and pre/post execution hooks.
- Content
Get an API key (free, instant, no payment):
bash curl -X POST https://governance.taskhawktech.com/signup \ -H "Content-Type: application/json" \ -d '{"agent_id": "your-agent-id"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The after_tool_call hook sends raw tool inputs and a summarized form of tool outputs to an external governance gateway. Those fields can contain secrets, personal data, prompts, file contents, command arguments, or API responses, and the code performs transmission automatically without any consent gate, minimization, or redaction at the send site. In an agent plugin whose purpose is governance over tool calls, this behavior is contextually expected, but it still creates a real data-exfiltration/privacy risk if high-risk tools process sensitive material.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest states that the plugin can automatically provision a free-tier API key from an external governance gateway if one is not supplied. That creates an implicit outbound enrollment/data-sharing path that is not necessary for local policy enforcement and can surprise operators by causing unauthenticated network registration to a third party. In a security plugin, this is especially risky because users may assume strict local trust controls while the plugin silently establishes remote service dependencies.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Automatic free-tier key provisioning is not clearly required for the plugin's stated governance role and introduces an opaque third-party trust bootstrap. This can cause systems to register with an external service unexpectedly, undermining least surprise and creating unnecessary exposure of host, agent, or usage metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes automatic transmission of post-execution tool output to a remote gateway without a strong, prominent warning about data sharing consequences. Since high-risk tools include shell, terminal, and file-editing actions, even truncated output may include credentials, source code, internal paths, or regulated data. In this context, the plugin's security branding makes users more likely to trust it, increasing the risk of unnoticed sensitive-data leakage.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The configuration advertises automatic post-execution attestation that sends truncated tool output to a remote gateway. Tool output can contain secrets, command results, file contents, tokens, or sensitive business data, so transmitting it off-host creates a direct exfiltration channel. Because this is enabled by default in a security/governance plugin, the mismatch between trust-signaling language and data export makes the issue more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The verify method sends action_type, action_payload, agent_id, and optional policy_context to a remote gateway, which can include user or system data. Although the file comments describe the client as shuttling JSON, there is no user-facing confirmation, logging, or explicit warning in the method about transmitting this data off-host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The attest method posts action_description, action_payload, agent_id, and optional context to the gateway, which may contain sensitive operational or user data. The comments explain the technical purpose, but there is no visible prompt, log, or explicit warning to the user that these details are transmitted externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The signup method performs a network call to obtain an API key and stores it internally, and ensureApiKey triggers this automatically when no key is configured. This is a credential-related operation, but the code provides no user-facing notice, confirmation, or logging that auto-provisioning will occur.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The plugin sends high-risk tool names and full tool inputs to an external governance gateway during verification, with no user-facing notice or consent mechanism at the point of disclosure. In agent contexts, tool inputs may contain secrets, personal data, prompts, or sensitive business content, so this creates a real confidentiality and privacy risk even if the transfer is intentional product behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The after-tool hook transmits an output summary, original tool input, and governance metadata to the remote attestation service automatically when autoAttest is enabled, without explicit disclosure to the user. Tool results frequently contain sensitive outputs such as command results, document excerpts, API responses, or secrets, so exporting even truncated summaries can leak confidential information to a third party.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This is a manifest file, so vague-trigger review applies. The description markets broad 'policy enforcement for agent tool calls' behavior but does not define when the skill should be invoked, what commands or contexts activate it, or any exclusion conditions, which can lead to unintended invocation in generic security/governance contexts.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "typecheck": "tsc --noEmit" }, "devDependencies": { "@types/node": "^20.19.37", "typescript": "^5.4.0" }, "engines": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json }, "devDependencies": { "@types/node": "^20.19.37", "typescript": "^5.4.0" }, "engines": { "node": ">=18.0.0"
Static analysis
No suspicious patterns detected.