Security audit

Execution Harness

Security checks for vulnerabilities and agentic risk

Overview

This is a useful execution-reliability hook package, but it asks for powerful local automation that is broader and less clearly disclosed than the hub-style description suggests.

Install only if you intend to grant Claude Code local hook automation. Review each shell script before enabling it, start with the minimal hooks, avoid cron-based tmux recovery unless panes are tightly scoped, do not store secrets in handoff or working-memory files, and periodically delete or protect ~/.openclaw/shared-context.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill declares itself as a non-operational navigation hub, yet the content includes concrete hook commands, external repository linkage, and examples that imply shell execution, file mutation, and network retrieval. When a skill advertises fewer capabilities than it actually enables or instructs, users and policy engines may grant trust under false assumptions, increasing the chance of unexpected code execution or filesystem changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description says the skill does not perform concrete operations, but the file materially instructs users to install executable hooks that can block stops, intercept tool use, run shell scripts, mutate session state, and affect commits and command execution. This mismatch is dangerous because reviewers or automated controls may treat the skill as informational while it actually serves as an operational bootstrap into broad local execution and workflow enforcement.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file metadata identifies this skill as "context-memory," while the surrounding manifest context describes a different skill, "execution-harness-hub." This identity mismatch is dangerous because it can cause the wrong skill to be loaded, reviewed, or trusted, undermining provenance checks and enabling capability confusion or accidental execution of unintended behavior.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file documents a concrete hook that reads local state and injects content back into the model context, which exceeds the skill's stated role as a navigation-only hub. That mismatch matters because users and reviewers may grant the skill broader trust than intended, while the documented behavior creates a hidden context-manipulation path.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Automatically reinjecting prior decisions modifies the agent's active reasoning context, which is a material capability not justified by a hub meant only to explain and route. This can cause the agent to act on stale, incorrect, or over-broad prior state without explicit user approval.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script performs persistent filesystem writes under the user's home directory, including session state and handoff artifacts, even though the surrounding skill is described as a navigation-only entry point. That mismatch expands the skill's effective capabilities and can surprise users or operators, especially because it stores conversational material across stops without an explicit trust boundary or consent mechanism.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script extracts `.last_assistant_message` from hook input and writes it to disk in a markdown handoff file. Persisting model output to disk creates a confidentiality and privacy risk because assistant messages may contain sensitive user-derived context, secrets, or internal reasoning artifacts that were not meant to be retained outside transient execution state.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata says this hub is a navigation-only entry point that should not perform concrete operations, but this section gives direct installation, configuration, and execution steps for hooks and scripts. That mismatch can cause an agent to perform changes or setup work the user did not intend when invoking what should have been a non-operational index skill.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This portion contains deep implementation guidance, runnable shell snippets, and procedural detail across multiple patterns, which exceeds a navigation hub's declared scope. In agent environments, overly capable hub content increases the chance of unintended autonomous configuration or modification rather than simple discovery and delegation.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill presents itself as guidance, but it also specifies concrete autonomous behaviors such as sending keystrokes, deleting lock files, updating state files, and running shell commands via hooks. That mismatch is dangerous because operators may enable it expecting passive advice, while it can actually mutate session state and perform recovery actions automatically.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script sends an Enter keystroke into any tmux pane whose recent output matches rate-limit text, which is an active control action against live sessions rather than passive monitoring. Even with a basic confirmation-prompt filter, pressing Enter in an arbitrary terminal can acknowledge prompts, rerun commands, or advance a workflow in unintended ways, creating integrity and safety risks across unrelated panes.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The code continuously scans all tmux panes and autonomously attempts recovery when it detects rate-limit-related text, which directly contradicts the stated skill behavior that it is only a navigational hub and does not perform concrete operations. This mismatch is dangerous because operators may trust the skill as informational while it actually manipulates active agent sessions, reducing transparency and increasing the chance of unintended execution.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file metadata identifies the skill as "multi-agent" with a description about multi-agent coordination, while the surrounding manifest context describes a different skill, "execution-harness-hub," focused on agent execution reliability. This mismatch can cause the wrong skill to be loaded, reviewed, trusted, or routed, creating confusion that weakens security review and may let unrelated or unsafe functionality bypass expected controls.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file metadata identifies the skill as "quality-verification," while the surrounding manifest context says the analyzed skill is "execution-harness-hub." This kind of identity mismatch can cause the wrong skill to be indexed, routed, audited, or granted trust based on another skill's metadata, which weakens security review and policy enforcement.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This script performs active repository operations by auto-detecting a test runner, executing tests, and denying a git commit when tests fail. That behavior materially exceeds a navigation-only or hub role, so the declared skill purpose understates its operational power and can mislead users or reviewers about what will execute in their environment.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest says the skill is only a navigation entry and does not perform concrete actions, but this file intercepts Bash git commit commands, runs project tests, and can deny the commit. That mismatch is dangerous because hidden side effects in an agent skill erode informed consent, can disrupt developer workflows, and create a path for unexpected code execution inside arbitrary repositories.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The provided file metadata identifies a different skill ('tool-governance') than the declared skill under review ('execution-harness-hub'), which indicates a packaging or routing mismatch. In an agent skill ecosystem, this can cause the wrong skill to be loaded, reviewed, or trusted, undermining provenance checks and potentially allowing unintended behavior or policy scope to be applied.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README instructs users to install shell-command hooks that can intercept tool use, write state to disk, run tests, and automatically execute local scripts, but it does not clearly foreground operational side effects such as filesystem writes, tmux/cron interaction, or command blocking. In a skill centered on execution control, this omission can cause users to enable powerful automation without informed consent, increasing the chance of unexpected system changes or workflow disruption.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs automatic persistence of handoff data to disk and describes hook-triggered scripts, but does not clearly disclose to the user that their task context and decisions may be written automatically. In an agent environment, silent filesystem writes and automation side effects can surprise users, leak sensitive project information into durable artifacts, and create integrity or privacy issues if those files are later reused.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section describes reading transcript data, extracting decisions, auditing compaction, and persisting memory artifacts, but omits any privacy/disclosure notice about processing potentially sensitive transcript contents. Because transcripts and decision logs can contain credentials, internal discussions, or proprietary data, undisclosed collection and retention increases confidentiality risk and can violate user expectations or policy boundaries.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill describes automatic restoration of prior decisions into context without notifying the user that their working context may be altered behind the scenes. Silent context modification reduces transparency and can mislead users about why the agent remembers or acts on previous content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The implementation explicitly reads transcript and local state files, yet the skill description does not warn users that stored project data will be accessed and reused. This creates a transparency and consent gap, especially where transcripts or decision logs may contain sensitive content.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to create and persist working files such as `.working-state/current-plan.md` and `decisions.jsonl`, but it does not include any warning, consent mechanism, or scoping guidance about filesystem modification and retention of potentially sensitive reasoning artifacts. In this context, the behavior is not overtly malicious, but it can cause unintended storage of sensitive project details, user data, or internal decision history across sessions, increasing privacy, compliance, and data leakage risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly instructs agents to persist 'key decisions', rejected options, risks, and modified files to disk, but it does not warn against including secrets, personal data, tokens, internal URLs, or other sensitive context. In an agent-reliability skill, this is more dangerous because the pattern is designed for repeated operational use and long-running tasks, increasing the chance that sensitive runtime context will be copied into durable files and later re-injected into prompts or exposed via logs, backups, or repository commits.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script silently stores assistant context into `handoffs/pre-compact-*.md` without any visible notice in the script output or embedded disclosure to the user whose conversation is being persisted. Undisclosed retention increases the risk of privacy violations, policy noncompliance, and accidental exposure because operators may not realize that conversational content is being archived.

Static analysis

No suspicious patterns detected.