T05 · Unauthorized Access and Privilege Escalation
Error
- Location
agentar_cli.mjs:851- Finding
Workspace Name Path Traversal Enables Writes Outside the Intended Agent Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Catchclaw Agentar
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it has review-worthy risks because it can install unverified remote agent packages and persistently modify or overwrite local OpenClaw workspaces.
Review this skill carefully before installing. Use only trusted registries and agentars, avoid --overwrite unless you intend to replace the main workspace, do not pass API keys on the command line, and choose simple alphanumeric agent names until the path validation issue is fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T08 · Insecure Dependencies
Error
- Location
agentar_cli.mjs:795- Finding
Remote Agent Packages Are Installed Without Cryptographic Authenticity Verification
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
agentar_cli.mjs:183- Finding
Trusted Executable Search Can Be Bypassed Through Path-Prefix Confusion
- Content
View full analysis
resolved.startsWith(prefix)); } function findOpenclawBin() { const isWin = process.platform === "win32"; const name = "openclaw"; const pathExts = isWin ? (process.env.PATHEXT || ".CMD;.EXE;.BAT;.PS1").split(";").map(e => e.toLowerCase()) : [""]; const pathDirs = (process.env.PATH || "").split(isWin ? ";" : ":"); for (const dir of pathDirs) { if (!dir || !isTrustedDir(dir)) continue; for (const ext of pathExts) { const candidate = path.join(dir, name + ext); try { if (fs.existsSync(candidate)) return candidate; } catch { /* skip */ } } } ``` The selected file is subsequently executed: ```js return spawnSync(openclawBin, args, { ...options, shell: false }); ``` ### Technical Analysis `isTrustedDir` uses a raw string-prefix comparison. This does not establish that the candidate directory is actually located beneath a trusted directory. For example, a directory named `~/.local-attacker` starts with the trusted string `~/.local` but is its sibling, not its descendant. Because the search iterates over attacker-influenced `PATH`, a forged `openclaw` executable in such a prefix-confusable directory can be selected and executed. Using `shell: false` prevents shell metacharacter injection but does not mitigate execution of the wrong binary. The code also tests only existence, without confirming that the candidate is a regular file, checking symlink targets, validating ownership, or verifying integrity. ### Attack Path 1. An attacker able to influence the victim's environment creates a writable directory whose name begins with a trusted prefix, such as `~/.local-attacker`. 2. The attacker places a malicious executable n ...[truncated 682 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
agentar_cli.mjs:305- Finding
API Key Is Accepted Through Process Arguments and Stored as Plaintext Without an Explicit Restrictive Mode
- Content
View full analysis
`. 2. The secret is recorded in shell history or exposed in process arguments while the command runs. 3. The CLI writes the secret to `skills/.credentials`. 4. A local process or user with sufficient read access retrieves the argument or plaintext file. 5. The recovered key is reused against the associated backend service. ### Impact Assessment Exposure grants whatever backend privileges are assig ...[truncated 279 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
agentar_cli.mjs:1114- Finding
Mandatory Explicit-Selection Gates Are Bypassed by Blank Input Defaults
- Content
View full analysis
= agents.length) { console.error("Error: invalid selection."); process.exit(1); } agentId = agents[idx].id; ``` The documented policy states: ```md Do NOT proceed with installation until the user has made a clear choice. NEVER assume or default to any mode without user confirmation. ``` ### Technical Analysis The implementation conflicts with the Skill's mandatory confirmation rules. During installation, any response other than the exact string `"2"` is interpreted as the new-agent mode, including blank or malformed input. During export, blank input automatically selects the first discovered agent. This converts a required affirmative user decision into a default action. It is particularly relevant in automated, piped, or unreliable terminal environments where an empty response may occur without deliberate selection. ### Attack Path 1. A user or automation invokes `install` without `--name` or `--overwrite`, or invokes `export` without `--agent`. 2. The prompt receives blank input, end-of-input behavior, or an unintended response. 3. Installation silently chooses the new-agent mode, or export silently chooses the first discovered agent. 4. The CLI proceeds despite the absence of the explicit selection requ ...[truncated 517 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
agentar_cli.mjs:17- Finding
Obfuscated Child-Process Import Conceals Local Command-Execution Capability
- Content
View full analysis
m.length === 13 && m[5] === '_' && m.startsWith('c')); const { spawnSync } = _require(`node:${_cp}`); ``` ### Technical Analysis The code reconstructs the name of Node.js's `child_process` module by searching built-in module names according to length and character positions. It then loads the module dynamically through `createRequire`. This mechanism provides no security benefit compared with a direct import. It makes the command-execution capability less visible to reviewers and simplistic static-analysis rules. The observed subprocess calls use argument arrays and `shell: false`, so this finding does not independently establish shell command injection. The risk is reduced auditability and concealment of a security-sensitive capability. ### Attack Path 1. A reviewer or automated scanner searches for direct imports of `node:child_process`. 2. The dynamically reconstructed module name avoids the expected import pattern. 3. The code obtains `spawnSync` and later executes a discovered `openclaw` binary. 4. If combined with executable lookup weaknesses or future unsafe argument handling, the concealed capability makes the dangerous behavior harder to detect during review. ### Impact Assessment This pattern does not independently grant additional privileges. Its impact is primarily on source-code transparency, maintainability, and the reliability of security review. It increases the chance that subprocess execution and associated vulnerabilities will be overlooked. ]]>- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js ]; const SKIP_FILES = ["AGENTS.md", "BOOTSTRAP.md"]; const EXPORT_SKIP_DIRS = [".git", ".openclaw", "__MACOSX", "memory"]; const SENSITIVE_PATTERNS = [".credentials", ".env", ".secret", ".key", ".pem"]; // ─── Config ──────────────────────────────────────────────────────────────────
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to run shell commands and use environment-dependent behavior, but it does not declare any tool scope such as allowed-tools or permissions. This creates a mismatch between documented capability and enforcement, increasing the chance the skill can invoke shell operations more broadly than intended without clear sandboxing or user-visible authorization boundaries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is designed to install archives that can create or overwrite agent workspaces containing configuration, skills, and behavior files. That is persistent state modification, and in this context it is security-relevant because a marketplace package can materially change future agent behavior or replace an existing workspace in one step.
- Content
md **Source:** This skill is from the [CatchClaw skill repository](https://github.com/OpenAgentar/catchclaw). An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command. ## Trigger Conditions
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger condition allows invocation on any mention of "agentar" or "catchclaw," which is overly broad for a skill that can search, install, overwrite workspaces, export archives, and rollback state. Broad activation increases the risk of accidental tool use in unrelated conversations and can expose users to unintended destructive or security-sensitive actions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The install commands write files into agent workspaces and optionally persist credentials in a skill-local
.credentialsfile, creating durable changes beyond the current session. Persistent writes are especially dangerous here because the source is a marketplace artifact that may contain untrusted instructions or configurations that influence later executions.- Content
bash $CLI install <slug> --name <name> [--api-key <key>] $CLI install <slug> --overwriteInstall an agentar from the marketplace.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Important:** - Do NOT execute install until the user explicitly selects one of the above options - Do NOT use "new" as a default without asking - Do NOT use "overwrite" unless the user explicitly selects it - If the user chooses "new" but doesn't specify a name, use the slug as the default name
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
During export, the code invokes the local openclaw CLI and passes agent content into another agentic system to synthesize metadata. This creates an unexpected execution/data-flow boundary where untrusted local workspace content can influence a secondary model/tool invocation, potentially causing prompt-injection-style behavior, unintended network/tool use by the downstream CLI, or leakage of sensitive workspace content into generated outputs or logs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The install flow executes the external openclaw binary to register agents, which is outside basic marketplace download/extract behavior and introduces side effects in the local agent runtime. Even with trusted-path checks and shell:false, this still allows the skill to modify local agent state and rely on an external executable whose behavior may vary, increasing attack surface and the chance of unauthorized persistence or configuration changes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js mode = "new"; } else { const choice = await prompt( `Install agentar "${slug}":\n [1] Create a new agent (default)\n [2] Overwrite main agent (~/.openclaw/workspace)\nChoice (1/2, default 1): `, ); mode = choice === "2" ? "overwrite" : "new"; if (mode === "new" && !opts.name) {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The CLI implements rollback and full local workspace restoration, which exceeds the stated marketplace scope of search/install/export and gives the skill destructive filesystem capabilities over ~/.openclaw/workspace. In an agent-skill context, this broadens impact significantly: a user invoking a marketplace helper could be induced to overwrite or restore local state, causing loss of data, tampering with agent configuration, or persistence of attacker-supplied content.
- Content