Cli Anything Zc

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:29 AM UTC
• Version: 0.1.2

Overview

This is mostly a coherent CLI-Anything helper, but it includes under-scoped guidance to install mutable local harness code into the current/system Python environment.

Review the referenced CLI-Anything checkout before using this skill to run or install any harness. Prefer a dedicated virtual environment, avoid --break-system-packages, require explicit approval before package installation or publishing, and treat generated harness code as untrusted until inspected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/validated-example-gimp.md:15

Finding

Unsafe Installation of Unreviewed Local Harnesses into System-Managed Python

Content

View full analysis

Vulnerability Details

File Location: references/validated-example-gimp.md:15-27; related workflow guidance in SKILL.md:70-75 and SKILL.md:94-101
Vulnerability Type: Unsafe third-party dependency installation and insufficient environment isolation
Risk Level: Medium

Vulnerable Code and Guidance

references/validated-example-gimp.md:15-27:

markdown

### Python dependencies installed for the harness

Installed into the current machine Python environment:

- `Pillow`
- `numpy`
- `prompt_toolkit`

### Harness installation

Installed from:

- `/root/.openclaw/workspace/CLI-Anything/gimp/agent-harness`

Command used conceptually:

```bash
python3 -m pip install --break-system-packages -e /root/.openclaw/workspace/CLI-Anything/gimp/agent-harness

text

Related instructions in `SKILL.md:70-75`:

```markdown
1. Locate `<software>/agent-harness/`
2. Read its `setup.py`, package layout, and local README/SOP file
3. Identify hard dependencies on the real software backend
4. Install or verify Python requirements only as needed
5. Validate the CLI entry point and a minimal command

Related instructions in SKILL.md:94-101:

markdown

- Treat third-party generated code as reviewable output, not automatically trusted output.
- For publishing, require explicit user intent before pushing anything external.
- If packaging for ClawHub, keep the skill lean and point to local references instead of pasting huge docs into `SKILL.md`.

## Useful script

Use `scripts/inspect_cli_anything.py` to quickly inspect the local repo and enumerate bundled harnesses.

Technical Analysis

The documented workflow installs an editable package from a separate, mutable local checkout into the current machine's Python environment. Python package installation can execute attacker-controlled or compromised packaging and build logic, including code referenced by setup.py, build b ...[truncated 2269 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the system-level installation example with an isolated virtual environment:

   bash

   python3 -m venv /root/.openclaw/workspace/.venvs/cli-anything-gimp
   /root/.openclaw/workspace/.venvs/cli-anything-gimp/bin/python -m pip install --upgrade pip
   /root/.openclaw/workspace/.venvs/cli-anything-gimp/bin/python -m pip install -e /root/.openclaw/workspace/CLI-Anything/gimp/agent-harness
   

2. Remove --break-system-packages from all recommended commands and explicitly prohibit installation into the operating system's Python environment.

3. Require review of setup.py, pyproject.toml, build-backend configuration, console entry points, imported initialization code, and dependency declarations before installation.

4. Pin transitive dependencies to reviewed versions. Where packages are downloaded, use a lock file and verified hashes, such as pip's --require-hashes, and restrict installation to approved package indexes.

5. Pin the external CLI-Anything checkout to a reviewed commit and verify its provenance and integrity before inspecting or installing any harness.

6. Prefer building a wheel in a restricted environment and inspecting its contents before installing it into the dedicated virtual environment.

7. Run initial installation and validation with least privilege, without secrets in the environment, and with filesystem and network access restricted where practical.

8. Update SKILL.md so that security review and isolated installation are mandatory workflow steps rather than advisory language.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says this skill is for creating or refining CLIs and packaging harnesses as skills. The provided code does none of that: it only scans a specific local path (/root/.openclaw/workspace/CLI-Anything), detects existing harness directories, checks for certain files, and prints a JSON report. Its primary purpose is inspection/inventory of existing CLI-Anything harnesses, not generation, refinement, adaptation, or packaging. That is a material purpose mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

- keep the OpenClaw `SKILL.md` focused on **when to use** and **how to navigate the local repo**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

- keep the OpenClaw `SKILL.md` focused on **when to use** and **how to navigate the local repo**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs the agent to run local Python scripts and inspect a local repository, which implies shell/code-execution capability, but it declares no tool scope or permission boundary. That can cause the skill to be invoked without clear execution constraints, increasing the chance of unintended command execution or broader-than-expected access during use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation criteria are very broad, covering many requests about GUIs, repos, SDKs, APIs, workflows, and packaging. Over-broad routing can cause this skill to trigger in unrelated contexts and then encourage shell-based repository inspection or command execution where a narrower, safer skill should have been used.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recommend_harness.py (reported line 28)May include surrounding context.

python

def main():
    raw = subprocess.check_output(['python3', str(INSPECT)], text=True)
    data = json.loads(raw)
    harnesses = data.get('harnesses', [])
    ranked = []

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Lines L69-L79 say the harness is a good validated demonstration target, but immediately note that its packaging/docs are 'not perfectly aligned' and specifically that setup.py describes a GIMP batch-mode harness while the README describes a Pillow-based image editing CLI. This is an intent/documentation contradiction within the file itself about what the harness actually is.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.