ClawHub
Back to skill

Security audit

Kpass

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed kpass/KeePass helper for agent access to a configured password vault, with serious but expected secret-handling risks.

Install only if you are comfortable giving the agent access to the configured vault. Use a dedicated automation vault with limited, replaceable credentials, avoid personal or administrative vaults, keep backups before writes, and make sure logs/transcripts cannot capture passwords or OTPs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

sh
kpass --non-interactive cp "old/path" "new/path"
kpass --non-interactive mv "old/path" "new/path"
kpass --non-interactive rm "old/path"

rm moves the target to the Recycle Bin. Use kpass --non-interactive rm -f "old/path" only when permanent deletion was explicitly authorized. Copying also duplicates secrets; verify the intended destination.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

kpass --non-interactive rm "old/path"

text

`rm` moves the target to the Recycle Bin. Use `kpass --non-interactive rm -f "old/path"` only when permanent deletion was explicitly authorized. Copying also duplicates secrets; verify the intended destination.

## Create a vault or change unlock credentials

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

  1. Install the skill in OpenClaw's shared skills directory (default state directory shown):

    sh
    mkdir -p ~/.openclaw/skills
git clone https://github.com/Lanjelin/openclaw-kpass.git ~/.openclaw/skills/kpass

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- Require kpass 0.2.0 or newer (Python 3.11 or newer). Install with `pipx install 'kpass-cli>=0.2.0'`; upgrade an existing installation with `pipx upgrade kpass-cli`.
- Check `kpass --version` before use. The skill depends on `--non-interactive` and `generate --quiet`, introduced in kpass 0.2.0.
- The process running agent commands must have `kpass` on `PATH` and access to the vault and its unlock credentials. Sandboxed execution needs these inside the sandbox too.
- Prefer preconfigured environment variables; do not ask the user to paste vault passwords or TOTP seeds into chat.

| Variable | Purpose |
| --- | --- |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

md
| `KPASS_PASSWORD` | Alternative: vault password in the process environment |
| `KPASS_KEYFILE` | Keyfile required by the vault, if any |

Use absolute paths. Restrict access to password files and keyfiles (for example, `chmod 600` on Unix). Do not print credentials or dump the environment to troubleshoot configuration.

Prefer environment configuration as an operating convention, not as a claim about CLI precedence: explicit `--db`, `--db-password-file`, and `--db-keyfile` options can override it. Avoid putting secrets in command-line arguments or shell history.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
| `KPASS_PASSWORD` | Alternative: vault password in the process environment |
| `KPASS_KEYFILE` | Keyfile required by the vault, if any |

Use absolute paths. Restrict access to password files and keyfiles (for example, `chmod 600` on Unix). Do not print credentials or dump the environment to troubleshoot configuration.

Prefer environment configuration as an operating convention, not as a claim about CLI precedence: explicit `--db`, `--db-password-file`, and `--db-keyfile` options can override it. Avoid putting secrets in command-line arguments or shell history.

Static analysis

No suspicious patterns detected.