ClawHub
Back to skill

Security audit

Humanos - Programmable Human Authorization for Agent Actions

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but its optional enforcement hook can fail open for sensitive actions and does not enforce mandate constraints before allowing tool execution.

Install only if you understand that the approval-request scripts are API clients and that the optional guard hook should not be treated as a complete security boundary. Keep credentials tightly permissioned, avoid custom VIA_API_URL values unless isolated test credentials are used, and require separate controls for exact action matching, amount/recipient/resource constraints, and fail-closed protection of high-risk tools.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
hooks/humanos-guard/handler.ts:113
Finding

Mandate constraints are retrieved but never enforced

Content
View full analysis
).blocked = true; (event.context as Record).blockReason = reason; } } else { console.log( `[humanos-guard] ALLOWED: ${toolName} — mandate ${result.mandate?.id} valid until ${result.mandate?.validUntil}` ); } ``` ### Technical Analysis The hook queries mandates using only a broad scope and tool name. It does not send a canonical representation of the proposed action, including critical attributes such as the payment amount, recipient, document identifier, destination account, or affected resource. Although the API response can contain `mandate.constraints`, the hook merely copies those constraints into the result object. It never compares them with the actual tool arguments before allowing execution. Consequently, any non-expired and non-rev ...[truncated 1442 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
hooks/humanos-guard/handler.ts:26
Finding

Keyword-based protection policy allows sensitive actions to bypass mandate checks

Content
View full analysis
p.trim()); } return SENSITIVE_KEYWORDS; } function _requiresMandate(toolName: string, args: Record): boolean { const patterns = _getProtectedPatterns(); const argsStr = JSON.stringify(args).toLowerCase(); const combined = `${toolName.toLowerCase()}:${argsStr}`; return patterns.some((pattern) => { try { return new RegExp(pattern.toLowerCase()).test(combined); } catch { return combined.includes(pattern.toLowerCase()); } }); } ``` ```typescript const toolName = event.context.toolName || "unknown"; const args = (event.context.args || {}) as Record; if (!_requiresMandate(toolName, args)) { return; } ``` ### Technical Analysis The hook determines whether authorization is necessary by searching the serialized tool name and arguments for a short list of keywords or administrator-supplied regular expressions. If no keyword matches, the handler returns and the tool call proceeds without a mandate check. Text matching is not a reliable security boundary. Equivalent operations can be described with synonyms, encoded values, opaque identifiers, or arguments that contain no descriptive text. The default policy also omits several sensitive operations listed in the project documentation, including deleting data, modifying permissions, rotating credentials, publishing under a user's identity, and controlling physical devices. The ...[truncated 1177 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sign-request.sh:8
Finding

Unrestricted API URL override can disclose bearer credentials and approval data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup-openclaw.sh:25
Finding

Installer does not enforce restrictive permissions on the credential configuration

Content
View full analysis
"$CONFIG_FILE" << 'JSONEOF' { "skills": { "entries": { "humanos": { "enabled": true, "env": { "VIA_API_KEY": "REPLACE_WITH_YOUR_API_KEY", "VIA_SIGNATURE_SECRET": "REPLACE_WITH_YOUR_SECRET" } } } } } JSONEOF echo " Created ${CONFIG_FILE} — edit it with your API credentials" else echo " Config already exists at ${CONFIG_FILE}" echo " Make sure it has VIA_API_KEY and VIA_SIGNATURE_SECRET for the humanos skill" fi ``` ### Technical Analysis The setup script creates `~/.openclaw/openclaw.json` without first applying a restrictive `umask` and without running `chmod 600` afterward. The resulting permissions depend on the user's environment. Under a permissive umask, the file may be readable by the user's group or other local accounts. Although the initially written values are placeholders, the installer explicitly tells the user to edit this same file and insert the real API key and signing secret. The script also does not verify or correct the permissions of an existing configuration file. Documentation that recommends `chmod 600` is not an effective enforcement mechanism because users can omit the manual step. ### Attack Path 1. Run the installer in an environment with a permissive umask. 2. The script creates `~/.openclaw/openclaw.json` with group-readable or world-readable permissions. 3. Insert the real `VIA_API_KEY` and `VIA_SIGNATURE_SECRET` as instructed. 4. Another local account or process reads the configuration file. 5. The exposed credentials are used to access the API or forge signed requests. ### Impact Assessment A local attacker may obtain both the bearer API key and HMAC signing secret. This can ...[truncated 284 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sign-request.sh:24
Finding

HMAC signing secret is passed through the OpenSSL process argument list

Content
View full analysis
` invocation. 4. Extract `VIA_SIGNATURE_SECRET` from the argument list. 5. Use the secret to generate valid HMAC signatures for forged requests, normally in combination with access to the associated API key. ### Impact Assessment A local observer may recover the HMAC signing secret. If the bearer API key is also available, the attacker can construct authenticated requests that appear to originate from the victim. The exact exploitability depends on operating-system process isolation and whether unprivileged users can inspect another user's process arguments. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs authenticated outbound API requests and uses HMAC signing secrets, but those powerful capabilities are not reflected in a narrowly scoped description about requiring approval. Hidden credentialed network access raises the risk of overtrust, data exfiltration to third parties, and misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
Use the signing script: `scripts/sign-request.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
| Resolve DID | `scripts/resolve-did.sh` | `GET` | `/v1/via/dids/:did` | `--did` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
| Resolve DID | `scripts/resolve-did.sh` | `GET` | `/v1/via/dids/:did` | `--did` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
| Resend OTP | `scripts/resend-otp.sh` | `PATCH` | `/v1/request/resend/:id` | `--id` (and optional `--contact`) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md
| Resend OTP | `scripts/resend-otp.sh` | `PATCH` | `/v1/request/resend/:id` | `--id` (and optional `--contact`) |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The script interpolates an externally supplied ID directly into the request path for a destructive DELETE operation, with no validation of allowed format or characters in this file. If the downstream curl wrapper does not safely constrain or encode the path, a caller may abuse the parameter to target unintended resources, produce malformed signed requests, or exploit path/query manipulation in the API call.

Content

Scanner excerpt · scripts/cancel-request.sh (reported line 20)May include surrounding context.

sh
source "$(dirname "$0")/sign-request.sh"

via_curl DELETE "/v1/request/${ID}"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup-openclaw.sh (reported line 17)May include surrounding context.

sh
# Remove existing symlink if present
if [[ -L "${SKILLS_DIR}/${SKILL_NAME}" ]]; then
  rm "${SKILLS_DIR}/${SKILL_NAME}"
  echo "  Removed existing symlink"
fi

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 99)May include surrounding context.

md
A mandate signature can represent:

- A simple yes/no approval
- A signed document (PDF)
- A payment authorization
- Identity verification (KYC)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

text

```bash
chmod 600 ~/.openclaw/openclaw.json
  1. Verify the skill loads:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 267)May include surrounding context.

md
- All requests signed with HMAC-SHA256
- API keys read from environment variables at runtime, never hardcoded in scripts
- When using OpenClaw, credentials are managed via `~/.openclaw/openclaw.json` — set secure file permissions (`chmod 600 ~/.openclaw/openclaw.json`)
- W3C Verifiable Credentials with EdDSA proofs
- OTP verification for all approval flows
- Guard hook uses native fetch API (Node.js 18+), no shell command execution

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 440)May include surrounding context.

md
- All requests signed with HMAC-SHA256
- API keys read from environment variables at runtime, never hardcoded in scripts
- When using OpenClaw, credentials are managed via `~/.openclaw/openclaw.json` — set secure file permissions (`chmod 600 ~/.openclaw/openclaw.json`)
- W3C Verifiable Credentials with EdDSA proofs
- OTP verification for all approval flows
- Guard hook uses native fetch API (Node.js 18+), no shell command execution

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares powerful capabilities through metadata and documented behavior (environment access, shell tooling, authenticated network calls) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for a runtime or reviewer to understand and constrain what the skill may do before installation or invocation.

Content

No source excerpt is available for this finding.