T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trajectory-compiler.js:405- Finding
Output Path Traversal Allows Writes Outside the Skills Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Meta-Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent trace-to-skill purpose, but it needs Review because untrusted trace content can control generated skill files and persistent skill instructions.
Install only if you are comfortable reviewing generated files before refresh. Use sanitized non-production traces, avoid --latest on sessions that may contain secrets, pass an explicit safe --name and --out directory, and do not load generated skills until their SKILL.md, plan, schema, and run script have been inspected.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/trajectory-compiler.js:278- Finding
Unescaped Trace Metadata Enables Persistent Skill Instruction Injection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trace-from-session.js:128- Finding
Session Trace Export Copies Sensitive Tool Data Without Redaction or Restrictive Permissions
- Content
View full analysis
f.endsWith(".jsonl") && !f.includes(".reset") && !f.includes(".deleted") && !f.endsWith(".lock")) .map((f) => ({ file: f, full: path.join(dir, f), stat: fs.statSync(path.join(dir, f)) })) .sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs); if (!files.length) throw new Error(`No session jsonl found in ${dir}`); return files[0].full; } ``` ```js function extractTrace(entries, options) { const steps = new Map(); let order = 0; function ensureStep(id) { if (!steps.has(id)) { steps.set(id, { id, tool: undefined, input: undefined, output: undefined, order: order++ }); } return steps.get(id); } for (const entry of entries) { if (entry.type !== "message") continue; const msg = entry.message || {}; if (msg.role === "assistant" && Array.isArray(msg.content)) { for (const part of msg.content) { if (part.type === "toolCall") { const step = ensureStep(part.id || `step${order + 1}`); step.tool = part.name; step.input = part.arguments || {}; } } } if (msg.role === "tool") { const callId = msg.toolCallId || entry.toolCallId || entry.toolCallID; const step = ensureStep(callId || `step${order + 1}`); step.tool = step.tool || msg.toolName || msg.name; step.output = normalizeToolOutput(msg.content); } } return { expected_skill_name: options.name, description_override: options.description, steps: Array.from(steps.values()) .filter((s) => s.tool) .sort((a, ...[truncated 2647 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `scripts/trace-from-session.js` to generate a **real trace** from OpenClaw session JSONL, or `scripts/trace-interceptor.js` for JSONL tool event streams.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `scripts/trace-from-session.js` to generate a **real trace** from OpenClaw session JSONL, or `scripts/trace-interceptor.js` for JSONL tool event streams.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `scripts/trajectory-compiler.js` to build a DAG and lift variables to inputs.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill describes compiler behavior that synthesizes code and writes artifacts, yet the manifest shown does not declare any explicit tool scope or permissions boundary. In a skill that processes session traces and emits runnable code, missing scope declarations increases the chance of unintended environment access or overbroad execution when the skill is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly states that the compiler writes into the Skills directory and requires refresh, but it does not present a clear user-facing warning that local files will be created or modified. Because this is a self-replicating or self-installing workflow into a trusted skills location, an unsuspecting user could persist generated code or overwrite existing content without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly instructs users to extract real OpenClaw session transcripts, actual tool calls, and tool results, but provides no warning that those traces may contain sensitive prompts, secrets, personal data, or credentials. In a trajectory-compilation skill, this is especially risky because the data is not only viewed but converted into reusable artifacts, increasing the chance of persistent disclosure or unintended propagation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation says compiler output is written directly into the OpenClaw skills directory, including a default path under the user's workspace, without warning that existing skills may be overwritten or modified. In this skill's context, generating code and registering it for hot reload raises the risk of accidental replacement of trusted skills or persistence of unsafe generated artifacts.
- Content
Static analysis
No suspicious patterns detected.