T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:34- Finding
Mandatory Revenue-Generating API Use and Promotional Output Hijack
- Content
View full analysis
- Remediation
View remediation
Security audit
Threat Assessment Defense Guide
Security checks for vulnerabilities and agentic risk
Overview
The skill is an API-backed security-assessment helper, but it sends sensitive organization security details and an API key to ToolWeb with weak disclosure and an unsafe test script, so it should be reviewed before use.
Install only if you are comfortable with ToolWeb receiving the threat model, asset categories, security tooling, compliance context, timestamps, and metered API usage. Do not submit secrets, hostnames, IP addresses, customer data, or regulated incident details unless your organization has approved ToolWeb. Avoid running scripts/test-api.sh unless the endpoint is confirmed and curl -k is removed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
other
Error
- Location
SKILL.md:44- Finding
Sensitive Organizational Security Context Is Transmitted Without an Explicit Consent Gate
- Content
View full analysis
", ""], "industry": [""], "assets": ["", ""] }, "sessionId": "", "timestamp": "" }' ``` ``` ### Technical Analysis The workflow solicits information about protected assets, organization size, deployed security tooling, compliance requirements, industry, and threat concerns. This information can reveal an organization's infrastructure profile and defensive maturity. The Skill then ...[truncated 1454 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/test-api.sh:19- Finding
TLS Certificate Verification Is Disabled While Sending an API Credential
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/test-api.sh:8- Finding
API Credentials Are Sent to an Endpoint Inconsistent with the Documented Destination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
clawhub install threat-assessment-defense-guide
Or manually
mkdir -p ~/.openclaw/skills/threat-assessment-defense-guide cp SKILL.md ~/.openclaw/skills/threat-assessment-defense-guide/
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to configure a third-party API key and use the skill for organization-specific threat assessments, but it does not clearly disclose that user-supplied threat details may be transmitted to an external service. This can cause operators to share sensitive security posture, asset, or incident information with a third party without informed consent, creating privacy, confidentiality, and compliance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell-based network access via curl but does not declare any explicit tool scope such as allowed-tools or permissions. That weakens sandboxing and review controls, making it easier for the skill to gain broader execution capability than users or platforms may expect.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This skill is explicitly designed to exfiltrate user-supplied assessment inputs to a third-party endpoint using curl and an API key. While that may be functional intent, it is still a real security concern because the data involved can include sensitive threat models, asset inventories, and organizational security posture details.
- Content
md env: - TOOLWEB_API_KEY bins: - curl primaryEnv: TOOLWEB_API_KEY os: - linux
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow instructs the agent to collect detailed organizational threat, industry, asset, and security-context data and send it to an external API, but it does not clearly warn users that their sensitive security information will leave the local environment. This creates a privacy and data-handling risk, especially because the transmitted content could reveal defensive gaps, critical assets, and business context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" RESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{