T08 · Insecure Dependencies
Warning
- Location
README.md:8- Finding
Unpinned and Unverified External CLI Installation Source
- Content
View full analysis
- Remediation
View remediation
Security audit
are.na claw
Security checks for vulnerabilities and agentic risk
Overview
The skill describes a normal are.na CLI, but its documented install path relies on an unreviewed, missing executable from a mutable placeholder GitHub source that would receive the user's API token.
Review this before installing. Do not provide an are.na API token to this skill until the actual `arena` source is included or the install source is replaced with a verified, pinned release with checksum or signature validation. If used anyway, inspect the downloaded executable first, restrict token-file permissions, and be prepared to revoke the are.na token.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstall
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstall
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstall
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstall
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -rf ~/arena-claw rm ~/.arena_token ~/.openclaw/.arena_tokens
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly states that API tokens are stored in local files, but it does not warn about file permission hygiene, plaintext credential exposure, backups, shell history leakage, or multi-user system risks. While local token storage is common for CLI tools, documenting plaintext credential locations without security guidance can lead users to leave sensitive credentials exposed.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
cp arena-claw/arena ~/bin/arena chmod +x ~/bin/arena
Add to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="$HOME/bin:$PATH"
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BIN_DIR="$HOME/bin" mkdir -p "$BIN_DIR" # Copy the arena script cp "$SCRIPT_DIR/arena" "$BIN_DIR/arena"