Security audit

CrabPet

Security checks for vulnerabilities and agentic risk

Overview

CrabPet is a coherent virtual pet skill, but it broadly reads local memory logs and uses an unsafe card-rendering path that should be reviewed before installation.

Review this before installing. Use it only if you are comfortable with the skill scanning OpenClaw memory logs to infer activity and personality, saving those derived traits locally, and generating shareable cards that may reveal usage patterns. Avoid untrusted or markup-like pet names, and prefer disabling or fixing the web/Chrome PNG renderer before using card generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:94
Finding: Mandatory Promotional Content Alters User-Facing Skill Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pet_engine.py:1077
Finding: Stored Pet Name Can Break Out of the HTML Script Context During Card Rendering
Content: View full analysis
Remediation: View remediation
``` Then parse its text content from trusted static JavaScript. 3. Escape characters significant to HTML parsing before embedding JSON. At minimum, encode `<` as `\u003c`; also consider escaping `>`, `&`, U+2028, and U+2029. 4. Prefer writing a separate JSON file with a strict schema and loading it through a controlled rendering mechanism. 5. Validate pet names: - Enforce a reasonable maximum length. - Reject control characters. - Reject or normalize markup delimiters if HTML embedding remains necessary. 6. Remove `--no-sandbox`. If environmental constraints make that impossible, run the renderer in a dedicated low-privilege container or namespace with: - No access to user files. - No network connectivity. - A read-only filesystem except for a dedicated output directory. - Resource and execution-time limits. 7. Add a restrictive Content Security Policy that blocks inline scripts and outbound connections. 8. Add regression tests using names containing ``, HTML tags, quotes, Unicode separators, and very long strings. ]]>

other

Note

Location: web/card.html:8
Finding: Local Card Generation Makes an Undisclosed Request to Google Fonts
Content: View full analysis
CrabPet Card @import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC:wght@400;700&display=swap'); * { margin: 0; padding: 0; box-sizing: border-box; } ``` The template is opened by headless Chrome in `scripts/pet_engine.py:1126-1139`: ```python proc = subprocess.run( [ chrome_bin, "--headless", "--disable-gpu", "--no-sandbox", "--screenshot=" + png_str, "--window-size=480,640", "--force-device-scale-factor=3", "--hide-scrollbars", file_url, ], timeout=30, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) ``` ### Technical Analysis The card template imports a stylesheet from `fonts.googleapis.com`. When the local HTML file is opened for PNG generation, the browser may automatically request the remote stylesheet and associated font resources. This request is not necessary for the core pet-state or card-generation functionality because the template already declares system-font fallbacks. It also contradicts the otherwise local nature of the generation workflow and is not disclosed in the Skill's operational instructions. No pet state is explicitly placed in the Google Fonts URL. Nevertheless, the request exposes connection metadata and the timing of card generation to an external service. ### Attack Path 1. The user asks the Agent to generate a PNG pet card. 2. The Skill invokes `pet_engine.py card`. 3. `_generate_web_card` creates a local rendered HTML file. 4. Headless Chrome opens the file. 5. The CSS parser processes the remote `@import`. 6. Chrome connects to Google Fonts and may retriev ...[truncated 632 chars]
Remediation: View remediation
``` 5. Document any external request that is intentionally retained and obtain explicit user consent before making it. 6. Add an offline rendering test to ensure PNG generation does not require network access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (20)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly says the skill reads existing memory/YYYY-MM-DD.md logs to derive pet state, but it does not warn that these logs may contain sensitive conversation history, prompts, secrets, or personal data. In a pet/companion skill, this access is broader than many users would expect, so the missing disclosure increases the risk of unintentional privacy exposure and over-collection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill instructs the agent to invoke python scripts, read state from disk, inspect memory/daily logs, and generate output files, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where a broadly capable runtime may allow file and shell operations beyond what users or the platform expect, especially because the scripts process user-derived local data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are overly generic, especially around words like 'pet' and 'show my pet', which can cause the skill to activate in unrelated conversations. Because this skill performs file reads and shell-backed actions, accidental invocation increases the chance of unnecessary access to user data and unintended state changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states that it reads memory/daily logs to calculate XP, personality, and mood, but it provides no privacy notice, consent step, or data-minimization guidance. This is dangerous because behavioral profiling is derived from potentially sensitive user history, and users may not realize that their logs are being scanned for keyword-based personality inference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Achievement names and comeback messages are specified in Chinese, while the rest of the skill instructions are in English, and there is no indication that language selection is optional or user-driven. This can force a locale/output language on users without opt-in, which violates the language-choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The design explicitly uses daily conversation logs, long-term memory, session records, and heartbeat data to infer pet traits and activity without describing any user notice, consent flow, minimization, or privacy controls. Even if the output is framed as a game mechanic, it derives behavioral profiling from sensitive usage history and can expose patterns the user may not expect to be repurposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is designed to mine conversation logs and long-term memory, then transform them into pet traits and summaries. That semantic transformation is risky because sensitive details from prior chats, preferences, schedules, or work habits can leak back to the user unexpectedly or into generated artifacts that may later be shared or stored.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The daily summary feature proposes natural-language summaries like 'today the owner wrote 3 scripts,' which directly converts prior user activity into readable output. Summarization increases leakage risk because private work patterns or topics from prior interactions may be surfaced more explicitly than in the underlying logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The sharing flow encourages users to publish pet cards and social content derived from interaction patterns, such as activity level, streaks, personality, and likely usage habits, but includes no warning that these traits may reveal behavioral information publicly. This creates a privacy exposure path where inferred personal patterns are repackaged into attractive shareable artifacts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The viral-growth and sharing sections create a clear path for third-party disclosure by encouraging publication of cards and achievement graphics derived from usage behavior. In this context, even seemingly playful labels like 'night owl' or streak metrics can reveal routines, work intensity, or interests to outsiders.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python skill hardcodes user-facing labels and achievement names in Chinese, and the rest of the file continues that pattern for status, card, and summary outputs. Because the skill does not provide any opt-in, locale selection, or justification for being Chinese-only, it violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill reads full OpenClaw memory log contents and performs keyword-based personality inference across them, which exceeds the minimum data needed for a pet companion. This creates a privacy issue because sensitive conversation content is repurposed for profiling, and the inferred traits are then persisted in pet state and surfaced in outputs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A pet-status skill should not need to invoke external browser binaries to produce output, especially from data gathered from user memory logs. This expands the trust boundary from simple local computation to complex third-party executables, making the skill more dangerous than its stated purpose suggests and increasing risk of local abuse, privacy leakage, or exploitation through the rendering path.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/pet_engine.py (reported line 1109)May include surrounding context.
python
# Try which for name in ["google-chrome-stable", "google-chrome", "chromium"]: try: proc = subprocess.run( ["which", name], stdout=subprocess.PIPE, stderr=subprocess.PIPE )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 92% confidence
Finding: The skill launches an external Chrome/Chromium process with a local rendered HTML file and the --no-sandbox flag. Even though arguments are passed as a list rather than via a shell, invoking a full browser to render data derived from workspace content increases attack surface and can expose the host to browser-based exploitation or unsafe local file rendering if untrusted content reaches the template.
Content: Scanner excerpt · scripts/pet_engine.py (reported line 1126)May include surrounding context.
python
# Use Chrome headless to take screenshot png_str = str(output_png_path) try: proc = subprocess.run( [ chrome_bin, "--headless",

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document declares lang="zh-CN", and later user-facing strings such as achievement names and demo labels are presented in Chinese without any visible language selection or opt-in. This can violate language/locale policy requirements when a skill forces a specific locale on all users by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file structure indicates auto-generated state and output files such as data/pet_state.json and output/pet_card.png, but the usage section does not clearly disclose that using the skill will persist data locally and create shareable artifacts. This is a transparency/privacy issue because saved pet state and generated cards may reveal behavioral metadata about a user's OpenClaw activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill generates a shareable PNG pet card containing user-derived attributes like level, personality tags, stats, and achievements, but it does not warn the user that personal usage-derived data will be embedded in a file intended for sharing. This can lead to inadvertent disclosure of behavioral patterns or activity history when users share the image publicly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root sets lang="zh-CN", and the page content also uses Chinese labels throughout, which imposes a specific language/locale experience. The file does not provide any user opt-in, alternate locale handling, or documentation that this is intentionally region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill's stated purpose is to show a local AI pet companion card and status, but this HTML imports a font from fonts.googleapis.com. External network access is not an obvious requirement for rendering a pet card and adds a capability outside the core companion/status context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.