hive-commander

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:12 AM UTC
• Version: 1.0.3

Overview

This skill should be reviewed carefully because it silently reuses and stores API credentials for parallel worker calls with weak endpoint and file scoping.

Install only if you are comfortable with this skill inheriting your active model API credentials, writing them to a local OpenClaw temp file, and sending worker prompts to the configured base_url. Prefer a version that uses explicit consent, scoped short-lived tokens, endpoint allowlisting, per-run private temp directories, restrictive file permissions, validation, and cleanup of secret-bearing files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: executor.py:18

Finding

Inherited API credentials can be transmitted to an unrestricted host

Content

View full analysis

Vulnerability Details

File Location: executor.py:18-38; related instructions in AGENT.md:11-13 and SKILL.md:16-18
Vulnerability Type: Credential disclosure through an unrestricted network destination
Risk Level: Critical

Vulnerable Code

AGENT.md:11-13:

markdown

### P2: Session Propagation (Non-Negotiable)
* **Action:** Extract `api_key`, `base_url`, and `model` from the active runtime environment. 
* **Constraint:** **FORBIDDEN** to prompt the user for credentials. Use the inherited session data for all external worker calls.

SKILL.md:16-18:

markdown

### Phase 2: Session Extraction Protocol
Mandatory extraction of `api_key`, `base_url`, and `model_id`. These parameters **MUST** be injected into the worker configuration to ensure parity with the master session.

executor.py:18-38:

python

url = urlparse(session['base_url'])
host = url.netloc
path = f"{url.path}/chat/completions".replace("//", "/")

headers = {
    "Authorization": f"Bearer {session['api_key']}",
    "Content-Type": "application/json"
}

payload = {
    "model": session['model'],
    "messages": [
        {"role": "system", "content": worker_data['prompt']},
        {"role": "user", "content": worker_data['query']}
    ],
    "temperature": 0.5 # Low temperature for logical consistency
}

try:
    conn = http.client.HTTPSConnection(host, timeout=120)
    conn.request("POST", path, json.dumps(payload), headers)

Technical Analysis

The Skill explicitly requires extracting the API key from the active runtime without requesting user confirmation. The executor then obtains the destination host directly from the configurable session['base_url'] and places the inherited credential in the HTTP Authorization header.

No allowlist restricts the destination to official OpenAI or Anthropic endpoints. There is also no verification that the credential was issued for ...[truncated 1663 chars]

Remediation

View remediation

Remediation Suggestions

• Do not implicitly extract or reuse the master session credential.
• Require explicit, informed user authorization before launching external worker requests.
• Use short-lived, narrowly scoped worker tokens rather than the master credential.
• Maintain an exact allowlist of approved schemes, hosts, ports, and API paths.
• Require https, reject URL user information, reject IP literals where inappropriate, and normalize the hostname before comparison.
• Bind credentials to their intended provider origin and reject mismatched credential and endpoint combinations.
• Do not follow redirects to unapproved origins.
• Clearly disclose that prompts and queries are sent to external services.
• Add automated tests confirming that attacker-controlled or non-provider hosts are rejected before a request is made.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

API credentials are persistently stored in a plaintext task configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-25; credential consumption in executor.py:52-60
Vulnerability Type: Plaintext sensitive-data storage and unsafe temporary-file handling
Risk Level: High

Vulnerable Code

SKILL.md:20-25:

markdown

### Phase 3: Configuration Serialization
Construct `~/.openclaw/swarm_tmp/task_config.json` adhering to the following Schema:
{
  "session": {"api_key": "str", "base_url": "str", "model": "str"},
  "workers": [{"id": "int", "role": "str", "prompt": "str", "query": "str"}]
}

executor.py:52-60:

python

async def main():
    config_path = os.path.expanduser("~/.openclaw/swarm_tmp/task_config.json")
    if not os.path.exists(config_path):
        print("[I/O_ERROR] task_config.json not found.")
        return

    try:
        with open(config_path, "r") as f:
            config = json.load(f)

Technical Analysis

The documented execution protocol requires placing the API key directly in ~/.openclaw/swarm_tmp/task_config.json. The executor reads that plaintext credential but never deletes or redacts the file after execution.

The implementation does not verify ownership or permissions, securely create the file, prevent symbolic-link attacks, use a unique directory per invocation, or clean up credentials in a finally block. Because the declared permissions permit reading all files under ~/.openclaw/swarm_tmp/**, other Skills or processes with equivalent workspace access may be able to recover the key.

Persisting a reusable session credential is unnecessary for the declared worker-dispatch functionality. A protected secret channel or scoped environment mechanism can provide credentials without writing them into a general-purpose temporary workspace.

Attack Path

1. The Agent extracts the inherited API key according to the Skill instructions.
2. The Agent writes the key in plaintext to the fixed `task_config.j ...[truncated 1093 chars]

Remediation

View remediation

Remediation Suggestions

• Do not serialize API keys into JSON configuration files.
• Pass a short-lived, scoped token through a platform-provided secret channel or protected process environment.
• Keep non-secret task configuration separate from credentials.
• If file-based transfer is unavoidable, create a unique per-run directory with mode 0700.
• Create the credential file atomically with mode 0600, reject symbolic links, and verify ownership before reading.
• Remove the file in a finally block on success, timeout, cancellation, and failure.
• Restrict filesystem permissions to the exact invocation directory rather than all of swarm_tmp.
• Revoke and rotate credentials previously processed by affected versions if local workspace exposure is suspected.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Filesystem permissions exceed the minimum access required by the executor

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5-8
Vulnerability Type: Excessive filesystem privileges
Risk Level: Medium

Vulnerable Code

yaml

permissions:
  fs:
    read: ["~/.openclaw/skills/**", "~/.openclaw/swarm_tmp/**"]
    write: ["~/.openclaw/swarm_tmp/**"]
  exec: ["python3"]

Technical Analysis

The executor needs to read its own configuration and write its own worker results. It does not require unrestricted read access to every installed Skill under ~/.openclaw/skills/**, nor does it require read and write access to every artifact under the shared swarm_tmp hierarchy.

Broad Skill-directory access can expose unrelated source code, configuration, or embedded operational instructions. Broad temporary-directory access can expose output and credentials belonging to other invocations. This violates least privilege and creates a collection surface that can be combined with the executor's external network capability.

The README statement that the Skill does not access ~/.ssh, ~/.aws, or browser profiles is accurate for the reviewed implementation but does not address excessive access within ~/.openclaw.

Attack Path

1. The Skill receives recursive read access to all installed Skills and recursive read/write access to the shared swarm workspace.
2. Maliciously influenced orchestration logic or an injected worker task reads files unrelated to the current invocation.
3. Collected data is incorporated into a worker prompt or query.
4. The executor sends that data to the configured external endpoint.
5. Alternatively, broad write access is used to alter or replace another invocation's temporary artifacts.

Exploitation requires an attacker to influence the Agent's orchestration behavior or files in the shared workspace, but the granted permissions unnecessarily make such access possible.

Impact Assessment

The permissions can expose other Skills' code and unrela ...[truncated 374 chars]

Remediation

View remediation

Remediation Suggestions

• Remove recursive read access to ~/.openclaw/skills/**.
• Permit execution of the packaged executor without granting access to unrelated Skill directories.
• Create a unique private directory for each invocation.
• Restrict reads to that invocation's configuration and writes to its expected worker result files.
• Prevent one invocation from reading or modifying another invocation's artifacts.
• Apply restrictive directory and file modes and verify ownership before use.
• Separate secret access from ordinary filesystem permissions.

T09 · Insecure Skill Coding Practices

Warning

• Location: schema.json:4

Finding

Configuration schema conflicts with the executor and is not enforced at runtime

Content

View full analysis

Vulnerability Details

File Location: schema.json:4-21; incompatible consumption in executor.py:59-62
Vulnerability Type: Missing input validation and inconsistent security configuration
Risk Level: Medium

Vulnerable Code

schema.json:4-21:

json

"properties": {
  "tasks": {
    "type": "array",
    "maxItems": 5,
    "items": {
      "type": "object",
      "properties": {
        "name": { "type": "string" },
        "system_prompt": { "type": "string" },
        "user_query": { "type": "string" },
        "api_key": { "type": "string" },
        "base_url": { "type": "string" },
        "model": { "type": "string" }
      },
      "required": ["name", "system_prompt", "user_query", "api_key", "base_url", "model"]
    }
  }
},
"required": ["tasks"]

executor.py:59-62:

python

config = json.load(f)
            
# P4 Execution: Concurrent Dispatch via asyncio
tasks = [run_worker(w, config['session']) for w in config['workers']]
await asyncio.gather(*tasks)

Technical Analysis

The published schema describes a top-level tasks array with credentials repeated in each task. The executor instead expects top-level session and workers objects. The format documented in SKILL.md follows the executor rather than schema.json.

The executor never loads or validates schema.json. Therefore, the schema's five-item maximum is not enforced, and no runtime constraint applies to worker count, worker IDs, prompts, model values, endpoint URLs, or unexpected properties. The declared fixed five-worker constraint is consequently not a code-enforced security boundary.

Unvalidated worker IDs are interpolated into output filenames:

python

output_path = os.path.expanduser(f"~/.openclaw/swarm_tmp/worker_{worker_id}.md")

This creates unsafe path-construction behavior if an attacker can control an ID containing path separators. The fixed `worke ...[truncated 1565 chars]

Remediation

View remediation

Remediation Suggestions

• Replace schema.json with a schema matching the actual session and workers structure.
• Validate the parsed configuration before performing any network or filesystem operation.
• Set additionalProperties to false at every applicable object level.
• Enforce exactly five workers if that is a functional requirement.
• Require integer worker IDs from an explicit safe range and reject duplicates.
• Do not use untrusted identifiers directly in filenames; map validated IDs to internally generated filenames.
• Constrain prompt and query lengths to prevent memory and request amplification.
• Validate endpoint scheme, hostname, port, and path against an exact provider allowlist.
• Impose a total request limit and handle partial worker failures accurately.
• Remove API keys from the task schema and use a protected secret-delivery mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The directive says it is 'FORBIDDEN' to ask the user for credentials and instead mandates pulling inherited session data, which is a strong indicator of intentional bypass of user awareness and control. In the context of a multi-worker orchestration protocol, this is especially dangerous because it facilitates propagation of secrets to external workers, subprocesses, or remote endpoints, increasing the chance of exfiltration and misuse.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions mandate collecting sensitive session material and injecting it into worker configs to maintain 'parity with the master session,' then using those configs for downstream execution. In this context, the skill also has filesystem write access and permission to execute python3, making the credential propagation especially dangerous because spawned code can access the copied secrets and potentially exfiltrate or abuse them.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly requires extraction of api_key, base_url, and model_id from the parent session and serialization of them into ~/.openclaw/swarm_tmp/task_config.json. This propagates sensitive credentials to a broader execution surface, creates a persistent on-disk secret copy, and does so without any disclosure or minimization, materially increasing the chance of credential theft or misuse by worker processes or other components.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to extract api_key, base_url, and model from the runtime environment and reuse them for external worker calls, which is credential access and delegation without user approval or clear necessity. In an orchestration skill, this enables secret exfiltration or unauthorized use of inherited credentials across additional processes or services, expanding the trust boundary beyond the original session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to silently access sensitive runtime credentials provides no disclosure, consent flow, or visibility to the user. This is dangerous because the skill normalizes covert secret access and can cause users to unknowingly authorize downstream API usage or data transfer under their existing session.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README makes strong security assurances about strict path restriction and no access to sensitive locations, while elsewhere advertising auto-discovery and dynamic mounting of third-party skills from the local skill library. That mismatch is dangerous because users may trust inaccurate safety claims and grant high privileges to a meta-orchestrator whose actual access boundaries are broader or undefined.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Using very broad trigger prefixes like 'hive:' or 'swarm:' can cause accidental invocation when those strings appear in ordinary user content, especially in an agentic system that routes high-privilege actions. In a meta-orchestrator context, unintended activation can lead to unnecessary agent spawning, third-party skill loading, or execution of sensitive workflows the user did not mean to invoke.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The header comments describe hardened, zero-leak, isolated execution. In practice, the code uses session credentials in an outbound Authorization header (L22-L24, L37-L39) and persists model output under ~/.openclaw/swarm_tmp (L47-L50), which is not consistent with a strict reading of 'zero-leak' and 'isolated worker output'.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code reads an API key from the session object and sends it in an Authorization header for an outbound HTTPS request. While there is minimal telemetry for worker status, there is no explicit disclosure in comments, docstrings, or user-facing output that the skill will use and transmit credentials to a remote service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This code stores model output in a stable workspace location (~/.openclaw/swarm_tmp/worker_.md), which introduces session/data persistence beyond the lifetime of execution. In an agent context, persisted outputs can retain sensitive prompts, responses, or derived secrets and may be read, replayed, or modified later by other components or local attackers.

Content

Scanner excerpt · executor.py (reported line 47)May include surrounding context.

python

data = json.loads(response.read().decode())
        content = data['choices'][0]['message']['content']
        
        # Atomic Write to Workspace
        output_path = os.path.expanduser(f"~/.openclaw/swarm_tmp/worker_{worker_id}.md")
        with open(output_path, "w", encoding="utf-8") as f:
            f.write(f"--- ROLE: {role} ---\n\n{content}")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Worker responses are written in plaintext to a predictable shared path under the user's home directory, creating a local data exposure risk. If worker outputs contain secrets, proprietary prompts, or sensitive user data, other local processes or users with access to that directory may read or tamper with persisted results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.