Security audit

Review Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This review-orchestration skill is mostly clear, but its quality-gate feature can run a workspace-supplied test command without defined validation or confirmation.

Install only if you are comfortable with /ro gate running test commands from the current workspace configuration. Review .openclaw/review-orchestrator.yaml and .claude/review-orchestrator.yaml before using /ro gate, especially in untrusted repositories, and prefer pinned or otherwise verified dependency versions where available.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:159
Finding: Workspace-Controlled Quality-Gate Configuration Enables Arbitrary Command Execution
Content: View full analysis
Checks use configured values from `quality_gates` section. Defaults: test_command=`npm test`, > coverage_threshold=5, require_docs=true. ``` ### Technical Analysis The skill instructs the agent to load `test_command` from configuration files located in the current workspace and execute that value as a quality-gate command. The documented interface represents the command as an unrestricted string rather than an allowlisted executable and structured argument array. A repository author can therefore supply a malicious `.openclaw/review-orchestrator.yaml` or `.claude/review-orchestrator.yaml` containing shell operators, command substitutions, pipelines, or an entirely different executable. If the underlying agent passes this string to a shell when `/ro gate` is invoked, the configuration becomes an arbitrary command-execution ...[truncated 1683 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: External Skill Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.
md
**What this skill does NOT do:** - Invoke AI models directly (instruction-only skill) - Call external services (Codex, Gemini, or any third-party API) - Send data to external services - Modify files outside its workspace (only writes to `docs/reviews/`) - Execute arbitrary code

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger is specified as "レビュー要求 (review requested)", which imposes a Japanese-language activation phrase in the skill description. The file does not offer alternative trigger languages as an explicit opt-in policy, nor does it document that the skill is intended only for a Japanese-language environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.
md
**What this skill does NOT do:** - Invoke AI models directly (instruction-only skill) - Call external services (Codex, Gemini, or any third-party API) - Send data to external services - Modify files outside its workspace (only writes to `docs/reviews/`) - Execute arbitrary code

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.
md
- Call external services (Codex, Gemini, or any third-party API) - Send data to external services - Modify files outside its workspace (only writes to `docs/reviews/`) - Execute arbitrary code **Cognitive modes clarification:** Mode names like "analyzer", "architect", and "implementer" describe review perspectives

Static analysis

No suspicious patterns detected.