ClawHub
Back to skill

Security audit

Iso42001 Aims Readiness

Security checks for vulnerabilities and agentic risk

Overview

This skill is an API-backed compliance assessor, but it forces paid third-party calls with potentially sensitive organization details and includes unsafe API-key handling guidance.

Review this carefully before installing. Use it only if you are comfortable sending organization name, AI use, governance status, and control gaps to ToolWeb, and only under acceptable privacy and contractual terms. Avoid running the bundled test script until TLS verification is fixed, and avoid storing a real API key in committed or broadly readable configuration files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:37
Finding

Forced Monetized External API Use Alters Agent Decision-Making

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/test-api.sh:22
Finding

TLS Certificate Verification Disabled for Authenticated API Requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:28
Finding

Documentation Encourages Plaintext API Key Storage in Application Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly says the agent will gather details about an organization's AI usage and governance and send them to an external API, but it provides no warning about data sensitivity, retention, jurisdiction, or user consent. Because this skill is intended for compliance and governance assessments, users may share sensitive internal control gaps, risk posture, or regulated-use information that should not be transmitted to a third party without clear disclosure and safeguards.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

clawhub install iso42001-aims-readiness

Or manually

mkdir -p ~/.openclaw/skills/iso42001-aims-readiness cp SKILL.md ~/.openclaw/skills/iso42001-aims-readiness/

text

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell-based network access via curl but does not declare any tool scope such as permissions or allowed-tools. This weakens execution boundaries and can permit broader-than-expected command capability, making external calls harder to govern and review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill is explicitly designed to send data to an external service and requires an API key plus curl to do so. External transmission is not inherently malicious here, but it is still a real security concern because user input and organization details leave the local trust boundary and are sent to a vendor-controlled endpoint.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
env:
        - TOOLWEB_API_KEY
      bins:
        - curl
    primaryEnv: TOOLWEB_API_KEY
    os:
      - linux

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs transmission of organization-specific governance and operational data to a third-party API without a clear user-facing consent step or privacy warning. Even if the data is not highly sensitive by default, it may reveal internal compliance posture, AI usage, and control gaps that organizations would treat as confidential.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The script sends an API key in a request to an external service and explicitly disables TLS certificate verification with curl -k. This creates a real risk of credential interception or man-in-the-middle attacks, especially because the skill is designed to contact a third-party portal over the network using a secret from the environment.

Content

Scanner excerpt · scripts/test-api.sh (reported line 22)May include surrounding context.

sh
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

RESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "$API_URL" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.