T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init_prd.py:20- Finding
Project Path Traversal Allows File Writes Outside the Intended Workspace
- Content
View full analysis
- Remediation
View remediation
Security audit
PM Skill
Security checks for vulnerabilities and agentic risk
Overview
This PRD-writing skill is not clearly malicious, but it asks the agent to run local scripts and mutate OpenClaw/workspace state with weaker path controls and operational side effects than its stated purpose supports.
Install only if you are comfortable with a PRD helper running local scripts, writing under OpenClaw workspace paths, and participating in SDLC state commits. Review and constrain init_prd.py path handling before use, avoid running preflight.sh on untrusted filenames, and treat deploy/rollback scripts as administrative operations that can replace installed skill files and restart the gateway.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
preflight.sh:27- Finding
Command Injection Through Test Filenames Executed with eval
- Content
View full analysis
"$TMP_TEST_LOG" 2>&1; then echo "❌ PREFLIGHT FAILED: $desc" echo "=== ERROR DETAILS (Extracting relevant logs to save tokens) ===" if grep -iE -A 10 -B 2 "error:|exception|failed|unresolved|expecting|traceback|❌" "$TMP_TEST_LOG" | head -n 50; then : else tail -n 50 "$TMP_TEST_LOG" fi echo "===============================================================" exit 1 fi ((TOTAL_PASSED++)) } run_e2e_test() { local cmd="$1" local desc="$2" if ! eval "$cmd" > /dev/null 2>&1; then echo "[E2E WARNING] $desc failed. Continuing." else ((TOTAL_PASSED++)) fi } ``` ```bash for f in scripts/test_*.sh; do run_test "bash $f" "Bash Test: $f" done ``` ```bash for f in scripts/test_*.py; do run_test "python3 $f" "Python Test: $f" done ``` ```bash for f in scripts/test_*.js; do run_test "node $f" "Node.js Test: $f" done ``` ### Technical Analysis The preflight script converts commands into strings and reparses those strings with `eval`. Test filenames discovered through shell globs are interpolated into the command strings without shell-safe quoting. A repository can contain filenames with shell metacharacters such as semicolons, command substitutions, redirections, or other operators. Although glob expansion initially produces a filename, `eval` performs a second round of shell parsing. During that second parse, metacharacters embedded in the filename become shell syntax rather than literal filename characters. Both `run_test()` and `run_e2e_test()` use this unsafe execution pattern. Fixed command strings such as `npm test` do not themselves introduce ...[truncated 1209 chars]- Remediation
View remediation
"$TMP_TEST_LOG" 2>&1; then echo "❌ PREFLIGHT FAILED: $desc" tail -n 50 "$TMP_TEST_LOG" exit 1 fi ((TOTAL_PASSED++)) } for f in scripts/test_*.sh; do run_test "Bash Test: $f" bash "$f" done for f in scripts/test_*.py; do run_test "Python Test: $f" python3 "$f" done for f in scripts/test_*.js; do run_test "Node.js Test: $f" node "$f" done ``` 3. Apply the same argument-array design to `run_e2e_test()`. 4. Use `--` where supported to prevent filenames beginning with hyphens from being interpreted as options. 5. Consider rejecting unexpected test filenames with a conservative naming policy. 6. Add regression tests using filenames containing spaces, semicolons, dollar signs, command substitutions, quotes, and leading hyphens. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build_release.sh:10- Finding
Release Denylist Can Include Sensitive Local Files in Distribution Artifacts
- Content
View full analysis
.release_ignore .git/ .sdlc/ docs/ tests/ *.log *.diff .review_count memory/ EOF fi rsync -av --exclude-from='.release_ignore' --exclude="$DIST_DIR/" ./ "$DIST_DIR/" ``` ### Technical Analysis The release process copies the entire current working tree into `dist/` and relies on a limited denylist to omit unwanted files. The generated denylist does not exclude common sensitive artifacts, including: - `.env` and environment-specific variants - API credential files - Private keys and certificates - Cloud or package-manager credentials - Local development configuration - Editor metadata and runtime caches - Untracked temporary files Denylist packaging is unsafe because newly introduced file types are included by default. The release content also depends on local working-tree state rather than a reviewed, explicit manifest. No sensitive file is present in the audited project snapshot, so there is no evidence of an existing secret disclosure. The vulnerability is the packaging behavior that will include such a file if it is present when the script runs. ### Attack Path 1. A developer or CI job has a sensitive local file in the project root or a copied subdirectory. 2. The filename does not match one of the limited `.release_ignore` patterns. 3. `build_release.sh` runs from that working tree. 4. `rsync` copies the sensitive file into `dist/`. 5. The generated release artifact is uploaded, published, or shared. 6. Anyone with access to the artifact can retrieve the included secret or sensitive configuration. ### Impact Assessment The impact depends on the accidentally included data. Exposure could disclose API toke ...[truncated 449 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims the agent must only obtain a safe path and then author the PRD, but it also mandates execution of a local initializer that creates or reuses files via fixed filesystem conventions. This is a real description/behavior mismatch because the skill is not merely guiding writing; it compels state-changing script execution on the local system, increasing trust in opaque helper code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims the agent must only obtain a safe path and then author the PRD, but it also mandates execution of a local initializer that creates or reuses files via fixed filesystem conventions. This is a real description/behavior mismatch because the skill is not merely guiding writing; it compels state-changing script execution on the local system, increasing trust in opaque helper code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims the agent must only obtain a safe path and then author the PRD, but it also mandates execution of a local initializer that creates or reuses files via fixed filesystem conventions. This is a real description/behavior mismatch because the skill is not merely guiding writing; it compels state-changing script execution on the local system, increasing trust in opaque helper code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims the agent must only obtain a safe path and then author the PRD, but it also mandates execution of a local initializer that creates or reuses files via fixed filesystem conventions. This is a real description/behavior mismatch because the skill is not merely guiding writing; it compels state-changing script execution on the local system, increasing trust in opaque helper code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill claims the agent must only obtain a safe path and then author the PRD, but it also mandates execution of a local initializer that creates or reuses files via fixed filesystem conventions. This is a real description/behavior mismatch because the skill is not merely guiding writing; it compels state-changing script execution on the local system, increasing trust in opaque helper code.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh mv -T "$TMP_DIR" "$PROD_DIR" rm -rf "$OLD_DIR" ls -dt "$RELEASES_DIR"/backup_*.tar.gz 2>/dev/null | tail -n +4 | xargs -r rm -f echo "✅ $SLUG deployed." if [ -z "$HOME_MOCK" ] && [ "$NO_RESTART" != "true" ]; then
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill directs the agent to read and write PRD files but does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and makes it harder to constrain or review what filesystem operations the skill is expected to perform.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance is broad enough that the skill may activate whenever the agent is asked to discuss or generate a PRD, without clear user-consented boundaries. Overbroad triggers increase the chance the agent will unnecessarily execute local scripts or write files in contexts where the user only wanted advice, not filesystem changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill uses mandatory language such as 'must and only' and 'must strictly' to force a specific workflow without user opt-in. This reduces user control and can pressure the agent into executing scripts and writing files even when the user may prefer a different process or only wants a draft in-chat.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Documentation Discipline (CRITICAL) - **BDD Acceptance Criteria:** In the Acceptance Criteria section, you MUST use BDD format (Given/When/Then) to define black-box behaviors. DO NOT write granular unit tests or implementation code here. - **Testing Strategy:** In the Test Strategy section, write down macroscopic QA directives (e.g., "Mock the DB", "Use E2E Sandbox"). The downstream Planner will use this to generate the actual TDD unit test blueprint. - **Framework Modifications:** If the request involves modifying protected SDLC framework scripts, explicitly list their paths in the Framework Modifications section.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill requires executing additional local scripts for auditing and baseline/commit operations after document writing. This expands the trust boundary from simple documentation editing into arbitrary local code execution and state mutation, which is dangerous because the scripts could perform unintended privileged actions unrelated to PRD generation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The planned 'Web search fallback for unknown archetypes' expands the skill beyond its declared local PRD-path discovery and file-writing workflow. This capability introduces external data access and prompt-injection exposure that are not necessary for the stated purpose, increasing the attack surface and creating opportunities for untrusted content to influence generated PRDs or downstream actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Web search is not justified by the documented PM/architect PRD-writing role, so adding it creates unnecessary capability creep. In this context, externally sourced content can be adversarial, misleading, or instruction-bearing, making the skill more dangerous because it is supposed to perform a bounded local workflow rather than consume untrusted internet data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script forcefully removes temporary/old directories with
rm -rfbut provides no user-facing warning, confirmation prompt, or explanatory comment about the deletion. Although this is a deploy script, the destructive cleanup action is not clearly disclosed beyond generic deployment messages.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script moves the current production directory aside, replaces it, and then permanently deletes the old directory with
rm -rf, but only prints generic deployment status messages. There is no explicit warning, confirmation, or inline explanation that the previous live install will be removed after replacement.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The design explicitly expands the skill from a constrained local PRD-generation workflow into an internet-enabled agent by mandating
web_searchfor unknown archetypes. This increases the attack surface, allows external content to influence generated PRDs, and can leak user/project details to third parties without being necessary for the core file-compilation task.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The web search capability is not aligned with the stated purpose of a tightly constrained PM skill that should follow a fixed PRD-writing process. Unjustified capabilities are risky because they violate least privilege and can be repurposed to fetch prompt-injection content, broaden data exposure, or bypass local governance controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Mandating
web_searchwithout a privacy or data-transmission warning is dangerous because user requirements, internal project details, or proprietary technology choices may be sent to external services. In this skill context, the PM may process early-stage product ideas, making unintended disclosure particularly sensitive.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The rollback script forcefully deletes the entire production skill directory and restores it from a tarball, which is a broader filesystem modification capability than the skill’s declared PRD-writing purpose. Even if intended for maintenance, this mismatch expands the blast radius: if the backup path or archive contents are tampered with, arbitrary files under the skills directory could be replaced or restored unexpectedly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Restarting the openclaw gateway gives this skill operational control over a broader service environment that is unrelated to PM/PRD generation. In the context of a narrowly scoped authoring skill, service restart capability is dangerous because it can disrupt availability, apply unauthorized changes immediately, or help conceal other modifications by reloading altered skill contents.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script invokes
openclaw gateway restart, which is a subprocess affecting system/service state, but the only surrounding output is a generic deployment success message. There is no explicit notice that deployment may restart the gateway unless--no-restartis used.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document requires use of the
writetool to save PRDs but provides no user-facing notice, confirmation, or overwrite safeguards. In an agent setting, silent file creation or overwriting can cause accidental data loss, repository pollution, or unauthorized persistence of generated content.- Content