ClawHub
Back to skill

Security audit

system-file-handler

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed filesystem skill, but it gives broad file read/write/delete/move authority through external binaries without clear path limits or verified runtime pinning.

Install only if you are comfortable giving this external MCP server filesystem access under your OpenClaw account. Configure it to the narrowest possible directory scope if the server supports that, avoid running OpenClaw with elevated privileges, verify the upstream source and dependencies yourself, and be especially careful with delete, move, and overwrite requests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned External Runtime and Dependency Retrieval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:6, SKILL.md:56-62, INSTALL.md:7-22, scripts/build.sh:9-18, and scripts/build.ps1:8-19
Vulnerability Type: Supply-chain risk caused by mutable external sources and unverifiable runtime components
Risk Level: Medium

Complete Code Snippets

SKILL.md:6:

text
metadata: {"openclaw":{"emoji":"📁","homepage":"https://github.com/go-fs-mcp/go-fs-mcp","requires":{"bins":["go-fs-mcp-skill","go-fs-mcp-server"],"config":["skill.json"]},"install":[{"kind":"go","package":"github.com/go-fs-mcp/go-fs-mcp-server/cmd/server@latest","bins":["go-fs-mcp-server"]},{"kind":"go","package":"github.com/go-fs-mcp/go-fs-mcp-skill/cmd/skill@latest","bins":["go-fs-mcp-skill"]}]}}

SKILL.md:56-62:

bash
From the go-fs-mcp source repository, build both binaries and place them in this Skill directory or add them to PATH:

git clone https://github.com/go-fs-mcp/go-fs-mcp.git
cd go-fs-mcp
go build -o go-fs-mcp-server/go-fs-mcp-server ./go-fs-mcp-server/cmd/server
go build -o go-fs-mcp-skill/go-fs-mcp-skill ./go-fs-mcp-skill/cmd/skill

INSTALL.md:7-22:

bash
git clone https://github.com/go-fs-mcp/go-fs-mcp.git
cd go-fs-mcp

export GOPROXY=https://goproxy.cn,direct
go mod tidy
go build -o go-fs-mcp-server/go-fs-mcp-server ./go-fs-mcp-server/cmd/server
go build -o go-fs-mcp-skill/go-fs-mcp-skill ./go-fs-mcp-skill/cmd/skill
chmod +x go-fs-mcp-server/go-fs-mcp-server go-fs-mcp-skill/go-fs-mcp-skill

scripts/build.sh:9-18:

bash
export GOPROXY="${GOPROXY:-https://goproxy.cn,direct}"

echo "==> go mod tidy"
go mod tidy

echo "==> build go-fs-mcp-server"
go build -o go-fs-mcp-server/go-fs-mcp-server ./go-fs-mcp-server/cmd/server

echo "==> build go-fs-mcp-skill"
go build -o go-fs-mcp-skill/go-fs-mcp-skill ./go-fs-mcp-skill/cmd/skill

scripts/build.ps1:8-19:

powershell
if (-not $env:GOPROXY) {
    $env:GOPROXY = "https://goproxy.cn,direct"
}

Write-Host "==> go mod tidy"
go mod tidy

Write
...[truncated 2841 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace every @latest package reference with an immutable, reviewed version or commit.
  2. Update clone instructions to check out a specific commit hash after cloning, and document the expected hash.
  3. Include the auditable runtime source, go.mod, and go.sum in the reviewed distribution or link the package to an immutable source archive.
  4. Build with dependency-lock integrity enforced, and avoid running go mod tidy as part of routine installation.
  5. Prefer an explicitly trusted dependency source. If a proxy is required, document its trust assumptions and provide a controlled fallback policy.
  6. Publish signed release artifacts and provide cryptographic checksums from an independently authenticated channel.
  7. Make installation scripts verify artifact signatures or checksums before making binaries executable or installing them into the Skill directory.
  8. Generate and publish an SBOM for both binaries, and scan direct and transitive Go dependencies before release.
  9. Run the server with least privilege and restrict its filesystem access to explicitly approved roots so a compromised dependency cannot access the entire user-visible filesystem.
  10. Require security review and reproducible-build verification before updating any pinned source or dependency version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/build.ps1 (reported line 25)May include surrounding context.

text
Write-Host "    server: $Root\go-fs-mcp-server\go-fs-mcp-server.exe"
Write-Host "    skill:  $Root\go-fs-mcp-skill\go-fs-mcp-skill.exe"
Write-Host ""
Write-Host "Next: copy binaries to your OpenClaw skill dir and edit skill.json mcp_command."

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/build.sh (reported line 26)May include surrounding context.

sh
Write-Host "    server: $Root\go-fs-mcp-server\go-fs-mcp-server.exe"
Write-Host "    skill:  $Root\go-fs-mcp-skill\go-fs-mcp-skill.exe"
Write-Host ""
Write-Host "Next: copy binaries to your OpenClaw skill dir and edit skill.json mcp_command."

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill exposes shell-reachable capabilities through external binaries and MCP stdio, but declares no explicit tool scope or permission boundaries. That makes it easier for an agent or integrator to invoke filesystem-affecting behavior without clear policy constraints, increasing the chance of unauthorized reads, writes, moves, or deletions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises delete and move capabilities but does not prominently warn about irreversible data loss or require heightened confirmation semantics. In an agent setting, natural-language requests can be ambiguous, so destructive file actions without explicit safety messaging increase the risk of accidental or over-broad deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly exposes destructive filesystem operations such as write, delete, and move, but the metadata provides no user-facing warning, safety boundary, or indication of confirmation requirements. In an agent setting, this increases the chance of accidental or unauthorized destructive actions because the capability is broad and delegated to an external MCP server that performs the actual I/O.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The visible skill metadata and trigger phrases are entirely in Chinese, but the manifest does not state that the skill is intended only for Chinese-speaking users or offer any language choice. This can violate language/locale policy expectations when skills should not force a specific language without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases map directly to destructive and sensitive filesystem actions such as reading, writing, deleting, and moving files, but the manifest provides no contextual guardrails, path restrictions, confirmation requirements, or activation scoping. In a filesystem skill that proxies requests to an external MCP server performing real I/O, overly broad triggers materially increase the chance of unintended or unauthorized file operations through accidental invocation, prompt injection, or abuse by downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest explicitly exposes write, delete, move, and directory-creation operations through an external filesystem service but provides no warning, confirmation requirement, path restriction, or indication of destructive risk. In a filesystem skill, these capabilities are expected, but without metadata-level guardrails or user-facing cautions they increase the chance of accidental or unsafe data modification when invoked by an agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file uses Chinese throughout, including headings, instructions, and trigger examples, with no indication that the user can choose another language. The policy explicitly calls for flagging language or locale constraints when a specific language is forced without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This PowerShell script contains natural-language comments and instructions in Chinese, including the usage description, without indicating that another language is available. Under the policy rule for language or locale, this effectively forces a specific language for users reading or maintaining the skill file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The display name, description, triggers, and parameter descriptions are all presented only in Chinese, with no indication that language is user-selectable or that the skill is intended solely for a Chinese-speaking or region-specific environment. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The display name, description, and all trigger phrases are defined only in Chinese, which can constitute a language/locale policy issue when no user opt-in or scope limitation is documented. There is no indication that the skill is intentionally limited to a Chinese-speaking environment or that alternate language support is available.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.