Axiomata Guard Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a security scanner, but its directory-scan behavior can silently miss executable skill files while presenting a security decision.

Install only if you understand this is a lightweight pattern scanner, not a complete skill security review. In particular, do not rely on its directory scan to approve a whole skill package; inspect scripts and other executable files separately.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/guard_scanner.py:378

Finding

Directory Scans Exclude Executable Skill Files

Content

View full analysis

Vulnerability Details

File Location: scripts/guard_scanner.py:378-381
Vulnerability Type: Incomplete security scanning coverage
Risk Level: Medium

python

if args.file:
    skill_path = Path(args.file)
    if skill_path.is_dir():
        skill_path = skill_path / "SKILL.md"
    try:
        with open(skill_path) as f:
            code = f.read()

Technical Analysis

When the supplied path is a directory, the scanner replaces it with the path to SKILL.md. It therefore scans only the documentation file and does not inspect other files in the skill package, including executable content under scripts/.

This behavior conflicts with the scanner's stated purpose of checking a skill for malicious code before installation. Because omitted files are not reported as skipped, an approval result may appear to cover the complete package even though only its manifest was analyzed.

Attack Path

1. An attacker creates a skill package containing an innocuous SKILL.md.
2. The attacker places malicious or otherwise dangerous code in another packaged file, such as scripts/payload.py.
3. A reviewer invokes the scanner with the skill directory through --file.
4. The scanner automatically changes the input path to <directory>/SKILL.md.
5. Only the benign Markdown file is passed to the detection engines.
6. The scanner may return an approval while the malicious executable file remains unexamined.
7. If the package is subsequently installed or invoked, the omitted code can execute according to the permissions of the invoking user or agent.

Impact Assessment

This flaw enables a security-control bypass and false-negative scan results. It does not itself execute attacker code or grant additional privileges. However, it can facilitate installation of an unreviewed malicious skill whose scripts may subsequently operate with all filesystem, process, network, and tool permissions available to t ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Recursively enumerate and scan all regular files beneath a supplied skill directory rather than rewriting the input path to SKILL.md.
• Prioritize executable and configuration formats, including Python, shell, JavaScript, TypeScript, PowerShell, YAML, JSON, and package manifests.
• Resolve each path and verify that it remains beneath the original package root.
• Do not follow symbolic links by default; otherwise, explicitly validate resolved symlink targets to prevent traversal outside the package.
• Apply per-file and aggregate size limits to prevent memory exhaustion.
• Handle binary, unreadable, and unsupported files explicitly and include them in a skipped_files or scan_errors section.
• Treat incomplete coverage as a warning or blocking condition rather than returning an unconditional approval.
• Include the list and count of scanned files in both human-readable and JSON reports.
• Add a regression test containing a benign SKILL.md and a malicious pattern under scripts/, verifying that a directory scan detects the script.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger text is very broad ('Before installing any skill, especially from ClawHub' and 'any security audit of OpenClaw skills'), which can cause the skill to activate in many routine security-related contexts. Over-broad activation increases the chance of unnecessary invocation of shell/network-capable logic, expanding attack surface and potentially letting adversarial content steer the agent into using this skill more often than intended.

Content

No source excerpt is available for this finding.