T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:233- Finding
Shell Command Injection Through Unsanitized Configuration Values
- Content
View full analysis
- Remediation
View remediation
Security audit
Setup OpenViking Remote Memory
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended to set up OpenViking memory, but it gives the agent broad install/configuration authority and includes unsafe command patterns that could execute unintended local commands.
Review this skill before installing. Only use it with a trusted OpenViking server, avoid pasting untrusted endpoint/API/agent values, and be aware it can install a plugin, change OpenClaw configuration, restart the gateway, and enable persistent remote memory. The unsafe shell substitution and environment-file sourcing should be fixed before routine use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:206- Finding
Unpinned Remote Plugin Installation Creates a Supply-Chain Risk
- Content
View full analysis
(CN) 连接没问题，现在开始安装插件... > (EN) Connection verified, installing the plugin now... Run this command: ```bash openclaw plugins install clawhub:@openclaw/openviking ``` **If the command succeeds (exit code 0):** Proceed to Step 7. **If the output contains "already installed" or similar:** That's fine, proceed to Step 7. **If the command fails:** Tell the user the error and suggest: > (CN) 插件安装失败。请检查网络连接。如果问题持续，尝试手动运行这个命令：`openclaw plugins install clawhub:@openclaw/openviking` > (EN) Plugin installation failed. Check your network. If the issue persists, try running: `openclaw plugins install clawhub:@openclaw/openviking` ``` ### Technical Analysis The installation command identifies a ClawHub package but does not pin a reviewed version or integrity digest. The code ultimately installed by this command can therefore change after the skill itself has been audited. There is no evidence in the reviewed file that the package name is intentionally deceptive or that the current dependency is malicious. The risk arises from reliance on mutable registry resolution and the absence of integrity verification. A compromised publisher account, registry compromise, unsafe future release, or package replacement could cause later skill invocations to install code different from the version originally reviewed. Because the installed component is an OpenClaw plugin, it may execute within a trusted application context and process conversation or memory data. ### Attack Path 1. The plugin publisher account, package distribution channel, or registry is compromised, or a future package release introduces unsafe code. 2. The package name continues to resolve successfully, but now points to the alter ...[truncated 982 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:269- Finding
Executable Environment Files Are Dot-Sourced Without Trust Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill promotes automatic memory across sessions via a remote service but does not present a clear upfront warning that conversation-derived data may be stored externally and persistently. This undermines informed consent and can lead users to disclose sensitive information without understanding that it will be sent to and retained by a remote memory backend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase "set up memory" is overly broad and can match unrelated requests about device memory, application settings, or non-OpenViking memory features. Because this skill performs installation, configuration, network access, and persistent cross-session changes, accidental activation could cause unintended system modifications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation rule "or shares a link/URL containing this skill" is unclear and overly permissive, allowing the skill to trigger based on incidental URL content rather than explicit user intent. In context, this is risky because the skill autonomously runs install and configuration commands and may connect to arbitrary remote endpoints supplied through conversation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to source a local environment file (
source ~/.openclaw/openviking.envor PowerShell dot-sourcing), which executes arbitrary shell commands from that file in the agent's current context. That is broader than necessary for remote plugin setup and creates a code-execution path from local file contents that may have been modified by another process, prior install step, or attacker.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The skill is designed for autonomous execution and explicitly forbids asking the user to run commands themselves, concentrating decision-making and system modification authority in the agent. In this context, the agent performs installation, configuration changes, network connectivity tests, and service restarts, so weak triggering or insufficient confirmation can turn benign automation into unintended privileged action.
- Content
md ## IMPORTANT RULES 1. **NEVER ask the user to run commands themselves.** You run everything. 2. **NEVER skip the health check (Step 5).** If the server is unreachable, do NOT proceed. 3. **NEVER proceed past a failed step.** Fix or report every error before moving on. 4. **ALWAYS use the exact commands shown.** Do not improvise or combine commands.
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The troubleshooting flow dumps the last 20 lines of general OpenClaw logs to the user, which may expose unrelated sensitive data such as tokens, URLs, internal paths, prompts, or other plugin activity. For a setup skill, broad log disclosure exceeds what is needed to verify activation and can leak information across contexts.
- Content